Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1426–1450 of 30,910 matching · newest first

ExploitedClear filters

High, CVSS 7.62 Oct 2026
Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks
Go github.com/xtls/xray-core · Upgrade to 1.260327.1-0.20260710210335-64fada32b5b9 (pre-release) or later · >= 1.260113.0, < 1.260327.1-0.20260710210335-64fada32b5b9 · GHSA-5wf9-h793-w73c · amended
2 Oct 2026Evidence →
Medium, CVSS 5.42 Oct 2026
Trigger.dev: Blind SSRF via alert-channel webhook
npm trigger.dev · Upgrade to 4.5.2 or later · <= 4.5.1 · CVE-2026-114076 · GHSA-q567-cr4x-96w4 · amended
2 Oct 2026Evidence →
High, CVSS 7.12 Oct 2026
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
npm trigger.dev · Upgrade to 4.5.2 or later · <= 4.5.1 · GHSA-pp95-gc86-jq6q · amended
2 Oct 2026Evidence →
High, CVSS 7.72 Oct 2026
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
npm trigger.dev · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-85650 · GHSA-xxv7-2vv3-h682 · amended
2 Oct 2026Evidence →
High, CVSS 7.12 Oct 2026
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
npm trigger.dev · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-85651 · GHSA-qxpp-qjg8-x4jv · amended
2 Oct 2026Evidence →
Medium, CVSS 6.12 Oct 2026
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
Packagist composer/composer · Upgrade to 2.10.3 or 2.2.30 by release line · >= 2.3.0, < 2.10.3; >= 1.0, < 2.2.30 · CVE-2026-59944 · GHSA-96h3-5x6v-m776 · amended
2 Oct 2026Evidence →
High, CVSS 8.82 Oct 2026
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
PyPI dulwich · Upgrade to 1.2.9 or later · < 1.2.9 · CVE-2026-114094 · GHSA-8mcx-5rqc-vhmf · amended
2 Oct 2026Evidence →
Medium, CVSS 6.52 Oct 2026
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
PyPI dulwich · Upgrade to 1.2.9 or later · < 1.2.9 · CVE-2026-114095 · GHSA-35mr-4567-66vg · amended
2 Oct 2026Evidence →
High, CVSS 8.62 Oct 2026
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
PyPI dulwich · Upgrade to 1.2.8 or later · >= 0.24.0, <= 1.2.7 · CVE-2026-114096 · GHSA-8w8g-wq8h-fq33 · amended
2 Oct 2026Evidence →
High, CVSS 8.62 Oct 2026
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
PyPI dulwich · Upgrade to 1.2.8 or later · >= 0.23.1, <= 1.2.7 · CVE-2026-114097 · GHSA-5fqc-mrg8-w798 · amended
2 Oct 2026Evidence →
High, CVSS 8.62 Oct 2026
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
PyPI dulwich · Upgrade to 1.2.8 or later · >= 0.22.5, <= 1.2.7 · CVE-2026-114098 · GHSA-cm62-gvxx-vmxx · amended
2 Oct 2026Evidence →
Low, CVSS 2.32 Oct 2026
xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release
crates.io xxhash-rust · Upgrade to 0.8.16 or later · < 0.8.16 · GHSA-6g2r-675j-hx59 · amended
2 Oct 2026Evidence →
High, CVSS 8.22 Oct 2026
Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution
Maven eu.copernik:copernik-xml-factory · Upgrade to 0.1.2 or later · < 0.1.2 · CVE-2026-61586 · GHSA-xm28-xvqc-gxxg · amended
2 Oct 2026Evidence →
Medium, CVSS 5.82 Oct 2026
Anubis: Policy bypass via client controlled X-Original-URI header
Go github.com/TecharoHQ/anubis · Upgrade to 1.26.0 or later · >= 1.22.0, < 1.26.0 · CVE-2026-62314 · GHSA-6wcg-mqvh-fcvg · amended
2 Oct 2026Evidence →
Medium, CVSS 6.32 Oct 2026
rmcp OAuth client fetches server-controlled resource_metadata URLs
crates.io rmcp · Upgrade to 2.0.0 or later · < 2.0.0 · GHSA-c9xm-49cp-xcr9 · amended
2 Oct 2026Evidence →
Medium, CVSS 5.72 Oct 2026
Rooting for GC values live across try_call may be missing, causing GC heap corruption
crates.io wasmtime · Upgrade to 49.0.2 or 48.0.4 by release line · >= 47.0.0, < 48.0.4; >= 49.0.0, < 49.0.2 · CVE-2026-115379 · GHSA-hw8m-q44c-ggrf
2 Oct 2026Evidence →
Medium, CVSS 5.92 Oct 2026
Mis-typed WebAssembly tag imports can lead to GC heap corruption
crates.io wasmtime · Upgrade to 49.0.2 or 48.0.4 by release line · >= 47.0.0, < 48.0.4; >= 49.0.0, < 49.0.2 · CVE-2026-115383 · GHSA-cfhf-m2cr-62wj · amended
2 Oct 2026Evidence →
Medium, CVSS 4.02 Oct 2026
WASI preview 0 implementation of poll_oneoff circumvents fuel consumption
crates.io wasmtime-wasi · Upgrade to 49.0.2, 48.0.4 or 36.0.17 by release line · >= 0.0.0-0, < 36.0.17; >= 37.0.0, < 48.0.4; >= 49.0.0, < 49.0.2 · CVE-2026-115380 · GHSA-j366-h8gg-77pm
2 Oct 2026Evidence →
Critical, CVSS 9.32 Oct 2026
Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow
crates.io wasmtime · Upgrade to 49.0.2 or 48.0.4 by release line · >= 39.0.0, < 48.0.4; >= 49.0.0, < 49.0.2 · CVE-2026-115384 · GHSA-32h6-97mm-8q3c · amended
2 Oct 2026Evidence →
Medium, CVSS 5.92 Oct 2026
Excessive allocated memory on the host when guests don't have stdio
crates.io wasmtime-wasi · Upgrade to 49.0.2, 48.0.4 or 36.0.17 by release line · >= 0.0.0-0, < 36.0.17; >= 37.0.0, < 48.0.4; >= 49.0.0, < 49.0.2 · CVE-2026-115381 · GHSA-gqmc-89g8-p25r · amended
2 Oct 2026Evidence →
Medium, CVSS 5.92 Oct 2026
Wasmtime wasi:http implementation panics with a zero timeout supplied
crates.io wasmtime-wasi-http · Upgrade to 49.0.2 or 48.0.4 by release line · >= 46.0.0, < 48.0.4; >= 49.0.0, < 49.0.2 · CVE-2026-115382 · GHSA-w4qr-p94g-mjhv · amended
2 Oct 2026Evidence →
Low, CVSS 2.12 Oct 2026
fd_readdir copies uninitialized struct padding into guest memory
crates.io wasmtime-wasi · Upgrade to 49.0.2, 48.0.4 or 36.0.17 by release line · >= 0.0.0-0, < 36.0.17; >= 37.0.0, < 48.0.4; >= 49.0.0, < 49.0.2 · CVE-2026-115386 · GHSA-96f6-r43r-8c24 · amended
2 Oct 2026Evidence →
Medium, CVSS 6.22 Oct 2026
Guest can panic host through filesystem timestamp before the epoch on wasip3
crates.io wasmtime-wasi · Upgrade to 49.0.2 or 48.0.4 by release line · >= 46.0.0, < 48.0.4; >= 49.0.0, < 49.0.2 · CVE-2026-115385 · GHSA-mr2v-56j5-cmfc
2 Oct 2026Evidence →
Medium, CVSS 5.71 Oct 2026
fzf vulnerable to denial of service through quadratic HTTP request-body accumulation
Go github.com/junegunn/fzf · Upgrade to 0.73.1 or later · < 0.73.1 · CVE-2026-53433 · GHSA-mvmf-94v6-879g · amended
1 Oct 2026Evidence →
Medium, CVSS 5.31 Oct 2026
Portainer CE allows username enumeration through authentication response timing
Go github.com/portainer/portainer · Upgrade to 0.6.1-0.20240417040827-48bc7d0d92f0 (pre-release) or later · < 0.6.1-0.20240417040827-48bc7d0d92f0 · CVE-2024-29296 · GHSA-87x6-8m9v-g8c2 · amended
1 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks

Trigger.dev: Blind SSRF via alert-channel webhook

Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)

Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)

Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release

Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution

Anubis: Policy bypass via client controlled X-Original-URI header

rmcp OAuth client fetches server-controlled resource_metadata URLs

Rooting for GC values live across `try_call` may be missing, causing GC heap corruption

Mis-typed WebAssembly tag imports can lead to GC heap corruption

WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

Excessive allocated memory on the host when guests don't have stdio

Wasmtime wasi:http implementation panics with a zero timeout supplied

fd_readdir copies uninitialized struct padding into guest memory

Guest can panic host through filesystem timestamp before the epoch on wasip3

fzf vulnerable to denial of service through quadratic HTTP request-body accumulation

Portainer CE allows username enumeration through authentication response timing

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence