Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1476–1500 of 30,910 matching · newest first

ExploitedClear filters

Medium, CVSS 5.41 Oct 2026
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
PyPI jupyterlab · Upgrade to 4.6.4 or 4.5.11 by release line · >= 4.6.0, <= 4.6.3; >= 4.0.0, <= 4.5.10 · CVE-2026-102904 · GHSA-3325-v43h-43rv · amended
1 Oct 2026Evidence →
High, CVSS 8.11 Oct 2026
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
PyPI jupyterlab · Upgrade to 4.6.4 or 4.5.11 by release line · >= 4.6.0, <= 4.6.3; >= 4.5.0, <= 4.5.10 · +3 more packages · CVE-2026-102831 · GHSA-6966-vjj6-99xv · amended
1 Oct 2026Evidence →
High, CVSS 7.51 Oct 2026
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)
Maven com.fasterxml.jackson.core:jackson-core · Upgrade to 2.22.3, 2.21.7 or 2.18.11 by release line · >= 2.19.0, <= 2.21.6; >= 2.22.0, <= 2.22.2; >= 2.8.0, <= 2.18.10 · +1 more package · CVE-2026-89425 · GHSA-7hhh-6rmp-j9qf · amended
1 Oct 2026Evidence →
High, CVSS 7.51 Oct 2026
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()
Maven com.fasterxml.jackson.core:jackson-core · Upgrade to 2.22.3, 2.21.7 or 2.18.11 by release line · >= 2.17.0, <= 2.18.10; >= 2.19.0, <= 2.21.6; >= 2.22.0, <= 2.22.2 · +1 more package · CVE-2026-89407 · GHSA-p6pp-m3f8-5c89 · amended
1 Oct 2026Evidence →
High, CVSS 7.51 Oct 2026
devalue: stringify/uneval serialize shared memory
npm devalue · Upgrade to 5.9.3 or later · >= 5.1.0, <= 5.9.2 · CVE-2026-92708 · GHSA-j22f-vq7h-c4qm · amended
1 Oct 2026Evidence →
Medium, CVSS 6.31 Oct 2026
devalue: Residual sparse-array CPU amplification in uneval
npm devalue · Upgrade to 5.9.3 or later · < 5.9.3 · CVE-2026-123566 · GHSA-hx4r-w6wj-j8fg · amended
1 Oct 2026Evidence →
High, CVSS 8.21 Oct 2026
devalue: Repeated primitive strings cause quadratic expansion in uneval
npm devalue · Upgrade to 5.9.3 or later · < 5.9.3 · CVE-2026-123565 · GHSA-mcm9-63f2-9j32 · amended
1 Oct 2026Evidence →
Low, CVSS 2.31 Oct 2026
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
npm devalue · Upgrade to 5.9.3 or later · >= 1.0.0, < 5.9.3 · CVE-2026-123564 · GHSA-wf3x-273g-mvxv · amended
1 Oct 2026Evidence →
High, CVSS 8.21 Oct 2026
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
npm devalue · Upgrade to 5.9.3 or later · < 5.9.3 · CVE-2026-123563 · GHSA-r9w8-h9r3-54w4 · amended
1 Oct 2026Evidence →
High, CVSS 8.21 Oct 2026
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
npm devalue · Upgrade to 5.9.3 or later · >= 5.8.0, < 5.9.3 · CVE-2026-123562 · GHSA-x5rw-q4pp-hg5g · amended
1 Oct 2026Evidence →
Medium, CVSS 6.31 Oct 2026
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
npm devalue · Upgrade to 5.9.3 or later · < 5.9.3 · CVE-2026-123561 · GHSA-4q55-j62x-fr9h · amended
1 Oct 2026Evidence →
High, CVSS 7.81 Oct 2026
virtualenv bash and fish activation scripts execute commands embedded in paths
PyPI virtualenv · Upgrade to 21.7.13 or later · <= 21.7.12 · CVE-2026-102925 · GHSA-p58f-9548-mpm2 · amended
1 Oct 2026Evidence →
High, CVSS 7.31 Oct 2026
virtualenv: Command injection via --prompt in activate.bat (batch activator)
PyPI virtualenv · Upgrade to 21.7.12 or later · <= 21.7.11 · CVE-2026-102937 · GHSA-x78j-v8h9-3j2q · amended
1 Oct 2026Evidence →
High, CVSS 8.71 Oct 2026
pypdf: Possible long runtimes with large amount of embedded files
PyPI pypdf · Upgrade to 6.19.0 or later · < 6.19.0 · CVE-2026-102999 · GHSA-v247-6f48-mgcj · amended
1 Oct 2026Evidence →
High, CVSS 8.71 Oct 2026
pypdf: Possible long runtimes when generating appearance streams
PyPI pypdf · Upgrade to 6.19.0 or later · < 6.19.0 · CVE-2026-102998 · GHSA-php9-fj8v-98fj · amended
1 Oct 2026Evidence →
High, CVSS 8.71 Oct 2026
pypdf: Possible large memory usage when retrieving alphabetical page labels
PyPI pypdf · Upgrade to 6.19.0 or later · < 6.19.0 · CVE-2026-103000 · GHSA-w23x-9jrw-r45c · amended
1 Oct 2026Evidence →
High, CVSS 8.71 Oct 2026
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102997 · GHSA-jw7q-gvrg-4vj3 · amended
1 Oct 2026Evidence →
High, CVSS 8.71 Oct 2026
pypdf: Possible large memory usage when parsing font data
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102996 · GHSA-g9cg-prrw-2r8q · amended
1 Oct 2026Evidence →
High, CVSS 8.71 Oct 2026
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
PyPI pypdf · Upgrade to 6.18.1 or later · < 6.18.1 · CVE-2026-102995 · GHSA-fp3h-c4fm-7vvf · amended
1 Oct 2026Evidence →
High, CVSS 8.71 Oct 2026
pypdf: Possible long runtimes/large memory usage when parsing indirect objects
PyPI pypdf · Upgrade to 6.18.0 or later · < 6.18.0 · CVE-2026-102994 · GHSA-5jq2-8x83-x246 · amended
1 Oct 2026Evidence →
High, CVSS 8.71 Oct 2026
pypdf: Possible large memory usage when retrieving Roman page labels
PyPI pypdf · Upgrade to 6.17.0 or later · < 6.17.0 · CVE-2026-102993 · GHSA-qv6h-rv94-w285 · amended
1 Oct 2026Evidence →
Critical, CVSS 9.21 Oct 2026
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
npm piscina · Upgrade to 6.0.0-rc.5 (pre-release), 5.3.2 or 4.9.4 by release line · >= 5.0.0, < 5.3.2; < 4.9.4; >= 6.0.0-rc.1, < 6.0.0-rc.5 · CVE-2026-102992 · GHSA-67c8-pqhq-4rmx · amended
1 Oct 2026Evidence →
High, CVSS 8.21 Oct 2026
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
npm basic-ftp · Upgrade to 6.2.1 or later · <= 6.2.0 · CVE-2026-102990 · GHSA-c475-qrg2-pj4r · amended
1 Oct 2026Evidence →
Medium, CVSS 5.81 Oct 2026
SiYuan discloses an administrator's open documents and search terms to anonymous readers
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260812083335-251596fc0de2 (pre-release) or later · < 0.0.0-20260812083335-251596fc0de2 · CVE-2026-72788 · GHSA-hgfg-j9pg-43xw · amended
1 Oct 2026Evidence →
Critical, CVSS 10.01 Oct 2026
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260721043339-eef10568384e (pre-release) or later · < 0.0.0-20260721043339-eef10568384e · CVE-2026-69085 · GHSA-33jq-p8c2-q3q4 · amended
1 Oct 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)

jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()

devalue: `stringify`/`uneval` serialize shared memory

devalue: Residual sparse-array CPU amplification in uneval

devalue: Repeated primitive strings cause quadratic expansion in uneval

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

devalue: Malformed null-prototype object keys bypass proto rejection via property-key coercion

virtualenv bash and fish activation scripts execute commands embedded in paths

virtualenv: Command injection via --prompt in activate.bat (batch activator)

pypdf: Possible long runtimes with large amount of embedded files

pypdf: Possible long runtimes when generating appearance streams

pypdf: Possible large memory usage when retrieving alphabetical page labels

pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)

pypdf: Possible large memory usage when parsing font data

pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)

pypdf: Possible long runtimes/large memory usage when parsing indirect objects

pypdf: Possible large memory usage when retrieving Roman page labels

piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env

basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

SiYuan discloses an administrator's open documents and search terms to anonymous readers

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence