Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1451–1475 of 30,910 matching · newest first

ExploitedClear filters

Medium, CVSS 6.81 Oct 2026
OpenShift Cluster Logging Operator missing authorization flaw
Go github.com/openshift/cluster-logging-operator · Upgrade to 0.0.0-20260804174055-1864c2a9851d (pre-release) or later · < 0.0.0-20260804174055-1864c2a9851d · CVE-2026-10609 · GHSA-9xm2-gw56-wj7m · amended
1 Oct 2026Evidence →
Medium, CVSS 4.11 Oct 2026
Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler
Go github.com/hatchet-dev/hatchet · Upgrade to 0.91.1 or later · < 0.91.1 · CVE-2026-61681 · GHSA-fjwv-jf2v-j499 · amended
1 Oct 2026Evidence →
Medium, CVSS 5.51 Oct 2026
Gardener: Authorization Bypass via Group Subject Injection
Go github.com/gardener/gardener · Upgrade to 1.144.2, 1.143.3 or 1.142.6 by release line · < 1.142.6; >= 1.143.0, < 1.143.3; >= 1.144.0, < 1.144.2 · CVE-2026-79767 · GHSA-gfjv-gqf2-c888 · amended
1 Oct 2026Evidence →
High, CVSS 8.21 Oct 2026
Zod can exhaust memory while validating oversized constrained collections
npm zod · Upgrade to 4.6.6 or later · < 4.6.6 · CVE-2023-54404 · GHSA-mrhx-c7xc-m3w5 · amended
1 Oct 2026Evidence →
Medium, CVSS 5.81 Oct 2026
SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260812083335-251596fc0de2 (pre-release) or later · < 0.0.0-20260812083335-251596fc0de2 · CVE-2026-73606 · GHSA-vg99-7gj7-2fr5 · amended
1 Oct 2026Evidence →
High, CVSS 8.61 Oct 2026
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260812083335-251596fc0de2 (pre-release) or later · >= 0.0.0-20260726161145-9b8e8956f997, < 0.0.0-20260812083335-251596fc0de2 · CVE-2026-73608 · GHSA-9cqf-hhrq-7v45 · amended
1 Oct 2026Evidence →
Medium, CVSS 5.81 Oct 2026
SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260812083335-251596fc0de2 (pre-release) or later · < 0.0.0-20260812083335-251596fc0de2 · CVE-2026-73609 · GHSA-j4ph-9xwf-wcj4 · amended
1 Oct 2026Evidence →
Medium, CVSS 5.81 Oct 2026
SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260812083335-251596fc0de2 (pre-release) or later · < 0.0.0-20260812083335-251596fc0de2 · CVE-2026-73605 · GHSA-hf8h-97gm-4x2p · amended
1 Oct 2026Evidence →
Medium, CVSS 5.81 Oct 2026
SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260812083335-251596fc0de2 (pre-release) or later · < 0.0.0-20260812083335-251596fc0de2 · CVE-2026-73607 · GHSA-53fp-9jmv-227g · amended
1 Oct 2026Evidence →
Medium, CVSS 6.81 Oct 2026
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.4, <= 3.11.6 · CVE-2026-92952 · GHSA-jf8q-945g-9q4c · amended
1 Oct 2026Evidence →
Critical, CVSS 9.91 Oct 2026
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
npm vm2 · Upgrade to 3.11.7 or later · >= 3.9.6, <= 3.11.6 · CVE-2026-92948 · GHSA-qhwx-74w5-xhxq · amended
1 Oct 2026Evidence →
High, CVSS 8.61 Oct 2026
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92950 · GHSA-jxxv-8r27-vm4p · amended
1 Oct 2026Evidence →
Critical, CVSS 10.01 Oct 2026
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92940 · GHSA-h85j-hv3c-qfgq · amended
1 Oct 2026Evidence →
Critical, CVSS 9.91 Oct 2026
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92951 · GHSA-c48m-32m9-vx93 · amended
1 Oct 2026Evidence →
High, CVSS 8.51 Oct 2026
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92958 · GHSA-6rh5-qq4q-97xh · amended
1 Oct 2026Evidence →
Critical, CVSS 9.91 Oct 2026
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92957 · GHSA-8686-vhfx-7r3j · amended
1 Oct 2026Evidence →
Medium, CVSS 4.01 Oct 2026
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
npm vm2 · Upgrade to 3.11.7 or later · >= 3.9.6, <= 3.11.6 · CVE-2026-92949 · GHSA-633r-hq9m-c4ff · amended
1 Oct 2026Evidence →
Critical, CVSS 9.01 Oct 2026
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.4, <= 3.11.6 · CVE-2026-92935 · GHSA-8hr7-r645-pc6w · amended
1 Oct 2026Evidence →
Critical, CVSS 10.01 Oct 2026
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.6, <= 3.11.6 · CVE-2026-92937 · GHSA-647f-g98j-qq25 · amended
1 Oct 2026Evidence →
Critical, CVSS 9.91 Oct 2026
vm2 allows a sandboxed plugin to execute native code through node:sqlite
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92938 · GHSA-6w8r-xxw2-g3hx · amended
1 Oct 2026Evidence →
Critical, CVSS 9.91 Oct 2026
vm2 crypto builtin loads attacker native code through setEngine
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92939 · GHSA-46pr-c5wc-xffx · amended
1 Oct 2026Evidence →
Critical, CVSS 9.81 Oct 2026
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
npm vm2 · Upgrade to 3.11.7 or later · >= 3.10.2, <= 3.11.6 · CVE-2026-92944 · GHSA-27g9-p43v-cw3v · amended
1 Oct 2026Evidence →
Critical, CVSS 10.01 Oct 2026
vm2 NodeVM can replace the host process TLS trust store
npm vm2 · Upgrade to 3.11.7 or later · >= 3.11.3, <= 3.11.6 · CVE-2026-92941 · GHSA-98xx-8mx4-x7cm · amended
1 Oct 2026Evidence →
Medium, CVSS 4.21 Oct 2026
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
npm vm2 · Upgrade to 3.11.7 or later · <= 3.11.6 · CVE-2026-92945 · GHSA-7q3f-wx44-378m · amended
1 Oct 2026Evidence →
Medium, CVSS 6.81 Oct 2026
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
PyPI jupyterlab · Upgrade to 4.6.4 or 4.5.11 by release line · >= 4.6.0, <= 4.6.3; >= 3.0.0, <= 4.5.10 · +1 more package · CVE-2026-102830 · GHSA-3jqq-pw4j-pqcj · amended
1 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence