Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

976–1000 of 30,910 matching · newest first

ExploitedClear filters

High, CVSS 7.513 Oct 2026
Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line · >= 8.0.0, <= 8.0.31; >= 10.0.0, <= 10.0.12; >= 9.0.0, <= 9.0.20; >= 11.0.0-preview.1, <= 11.0.0-rc.1 · CVE-2026-70183 · GHSA-494h-xx7x-5frh · amended
13 Oct 2026Evidence →
Medium, CVSS 5.913 Oct 2026
Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 10.0.13, 9.0.21 or 8.0.32 by release line · >= 8.0.0, <= 8.0.31; >= 10.0.0, <= 10.0.12; >= 9.0.0, <= 9.0.20 · CVE-2026-70196 · GHSA-57xr-hfxx-jw5x · amended
13 Oct 2026Evidence →
Critical, CVSS 9.813 Oct 2026
Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability
NuGet microsoft.native.quic.msquic.schannel · Upgrade to 2.5.11-ci.159417053 (pre-release) or later · >= 2.5.11-ci.156755675, <= 2.5.11-ci.156755675 · CVE-2026-105016 · GHSA-5gjq-3f94-rcf7 · amended
13 Oct 2026Evidence →
High, CVSS 7.513 Oct 2026
Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 10.0.13, 9.0.21 or 8.0.32 by release line · >= 9.0.0, <= 9.0.20; >= 10.0.0, <= 10.0.12; >= 8.0.0, <= 8.0.31 · CVE-2026-70181 · GHSA-w5qq-qrpp-rf4c · amended
13 Oct 2026Evidence →
High, CVSS 8.113 Oct 2026
Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 10.0.13, 9.0.21 or 8.0.32 by release line · >= 9.0.0, <= 9.0.20; >= 10.0.0, <= 10.0.12; >= 8.0.0, <= 8.0.31 · CVE-2026-70175 · GHSA-x3vp-85cm-q97r · amended
13 Oct 2026Evidence →
High, CVSS 7.513 Oct 2026
Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability
NuGet microsoft.aspnetcore.signalr.common · Upgrade to 11.0.0-rc.2 (pre-release), 10.0.13, 9.0.21 or 8.0.32 by release line · >= 10.0.0, <= 10.0.12; >= 11.0.0-preview.5, <= 11.0.0-rc.1; >= 8.0.0, <= 8.0.31; >= 9.0.0, <= 9.0.20 · CVE-2026-70159 · GHSA-334f-vvp4-7g6p · amended
13 Oct 2026Evidence →
Unrated13 Oct 2026
AsyncFd::new and related constructors violate I/O safety
crates.io tokio · Upgrade to 1.53.3 or 1.51.6 by release line · >= 0.3.2, < 1.51.6; >= 1.52.0, < 1.53.3
13 Oct 2026Evidence →
High, CVSS 7.511 Oct 2026
Decompression bomb in ruzstd: a tiny input can exhaust memory (OOM)
crates.io ruzstd · Upgrade to 0.9.1 or later · >= 0.0.0-0, < 0.9.1
11 Oct 2026Evidence →
Critical, CVSS 9.110 Oct 2026
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
crates.io zip · Upgrade to 9.0.0 or later · >= 0.0.0-0, < 9.0.0 · GHSA-4684-h2q9-2vcp
10 Oct 2026Evidence →
Medium, CVSS 6.99 Oct 2026
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Go code.vikunja.io/api · Upgrade to 2.7.0 or later · >= 0.13.0, < 2.7.0 · CVE-2026-111921 · GHSA-fmmf-xq98-g327 · amended
9 Oct 2026Evidence →
Medium, CVSS 5.49 Oct 2026
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
Go code.vikunja.io/api · Upgrade to 2.7.0 or later · >= 2.6.0, < 2.7.0 · CVE-2026-111920 · GHSA-pjr3-86v4-5p7w · amended
9 Oct 2026Evidence →
Medium, CVSS 5.49 Oct 2026
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
Go code.vikunja.io/api · Upgrade to 2.7.0 or later · >= 1.0.0-rc0, < 2.7.0 · CVE-2026-111918 · GHSA-fprf-r6rv-xg99 · amended
9 Oct 2026Evidence →
Medium, CVSS 6.59 Oct 2026
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
Go code.vikunja.io/api · Upgrade to 2.7.0 or later · >= 2.3.0, < 2.7.0 · CVE-2026-111917 · GHSA-4hv6-xc92-j86g · amended
9 Oct 2026Evidence →
High, CVSS 7.59 Oct 2026
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260901043436-8c9b9a1aff21 (pre-release) or later · >= 1.9.10-0.20260729084040-acb59fdd81db, < 1.9.10-0.20260901043436-8c9b9a1aff21 · CVE-2026-107805 · GHSA-j3hg-9rp3-5hw9 · amended
9 Oct 2026Evidence →
Medium, CVSS 5.39 Oct 2026
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260904075558-e30e331303fc (pre-release) or later · >= 1.9.10-0.20251005005631-6de168c9454, < 1.9.10-0.20260904075558-e30e331303fc · CVE-2026-107804 · GHSA-9h23-53f4-q947 · amended
9 Oct 2026Evidence →
High, CVSS 8.29 Oct 2026
Tina: Code injection via unescaped Git branch name in generated client source
npm @tinacms/cli · Upgrade to 3.0.0 or later · <= 2.7.0 · CVE-2026-108259 · GHSA-pwhx-cvv3-qj5c · amended
9 Oct 2026Evidence →
Critical, CVSS 9.39 Oct 2026
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
npm tinacms · Upgrade to 3.14.0 or later · <= 3.13.0 · +1 more package · CVE-2026-108261 · GHSA-x34j-47hf-4xg7 · amended
9 Oct 2026Evidence →
High, CVSS 7.69 Oct 2026
@tinacms/web-components: tina-markdown writes rich-text link URLs into href without scheme validation, allowing stored XSS
npm @tinacms/web-components · Upgrade to 0.2.1 or later · <= 0.2.0 · CVE-2026-108260 · GHSA-c42q-qvc3-j6vg · amended
9 Oct 2026Evidence →
Medium, CVSS 6.99 Oct 2026
Shiny for Python has path traversal in bookmark restore
PyPI shiny · Upgrade to 1.6.4 or later · >= 1.4.0, <= 1.6.3 · CVE-2026-108258 · GHSA-47c3-hpmg-7j6p · amended
9 Oct 2026Evidence →
Medium, CVSS 5.39 Oct 2026
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · GHSA-8wvg-r2j4-3737 · amended
9 Oct 2026Evidence →
Medium, CVSS 6.09 Oct 2026
Vikunja: Cross-project task disclosure through subtask expansion
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · GHSA-3hc7-r24j-rpwc · amended
9 Oct 2026Evidence →
Medium, CVSS 6.39 Oct 2026
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID
Go code.vikunja.io/api · Upgrade to 2.6.0 or later · <= 2.5.0 · GHSA-g38j-7v97-x298 · amended
9 Oct 2026Evidence →
Medium, CVSS 5.39 Oct 2026
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
Packagist contao/core-bundle · Upgrade to 5.7.12 or 5.3.50 by release line · >= 4.0.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 · CVE-2026-107842 · GHSA-x2rp-9qf7-2fmq · amended
9 Oct 2026Evidence →
Medium, CVSS 5.39 Oct 2026
Contao: The registration module re-sends activation mails
Packagist contao/core-bundle · Upgrade to 5.7.12 or 5.3.50 by release line · >= 4.1.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 · CVE-2026-107843 · GHSA-mfxh-vp55-7gc6 · amended
9 Oct 2026Evidence →
Low, CVSS 3.59 Oct 2026
Contao: Cross-site request forgery in custom backend actions
Packagist contao/core-bundle · Upgrade to 5.7.12 or 5.3.50 by release line · >= 4.0.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 · CVE-2026-107848 · GHSA-9ff2-p842-45wq · amended
9 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability

`AsyncFd::new` and related constructors violate I/O safety

Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM)

ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target

Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check

Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout

Tina: Code injection via unescaped Git branch name in generated client source

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

Shiny for Python has path traversal in bookmark restore

Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint

Vikunja: Cross-project task disclosure through subtask expansion

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled

Contao: The registration module re-sends activation mails

Contao: Cross-site request forgery in custom backend actions

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence