Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1501–1525 of 30,910 matching · newest first

ExploitedClear filters

Unrated1 Oct 2026
TLS Hostname Verification Falls Back to CN After SAN Mismatch
Bitnami php +2 · Upgrade all 3 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-91769 · GHSA-vvx9-73fr-5jjx · amended
1 Oct 2026Evidence →
Unrated1 Oct 2026
Integer overflow to buffer overflow in soap HTTP parsing
Bitnami php +2 · Upgrade all 3 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2025-14181 · GHSA-cj93-vc83-wgqv · amended
1 Oct 2026Evidence →
Unrated1 Oct 2026
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
Bitnami php +2 · Upgrade all 3 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-93682 · GHSA-7875-c8px-7q5f · amended
1 Oct 2026Evidence →
Unrated1 Oct 2026
Cross-origin credential leak in HTTP stream wrapper redirects
Bitnami php +2 · Upgrade all 3 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-91766 · GHSA-fpwc-w8rq-cr92 · amended
1 Oct 2026Evidence →
Unrated1 Oct 2026
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
Bitnami php +2 · Upgrade all 3 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-91765 · GHSA-rgrp-mwpx-f6rm · amended
1 Oct 2026Evidence →
Unrated1 Oct 2026
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
Bitnami php +2 · Upgrade all 3 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-6103 · GHSA-j3wh-g957-2m85 · amended
1 Oct 2026Evidence →
Unrated1 Oct 2026
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
Bitnami php +2 · Upgrade all 3 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-17545 · GHSA-9f67-6fw4-hpfp · amended
1 Oct 2026Evidence →
Unrated1 Oct 2026
Various packet overreads in mysqlnd_writeprotocol.c
Bitnami php +2 · Upgrade all 3 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2025-1218 · GHSA-r6x9-5r99-36j7 · amended
1 Oct 2026Evidence →
High, CVSS 7.730 Sep 2026
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
PyPI virtualenv · Upgrade to 21.7.12 or later · <= 21.7.11 · CVE-2026-102930 · GHSA-94p9-xgh2-xp45 · amended
30 Sep 2026Evidence →
Medium, CVSS 5.830 Sep 2026
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
PyPI virtualenv · Upgrade to 21.7.11 or later · <= 21.7.10 · CVE-2026-102938 · GHSA-9h9j-4vrj-gf7g · amended
30 Sep 2026Evidence →
Medium, CVSS 5.930 Sep 2026
fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
npm fastify · Upgrade to 5.12.5 or later · < 5.12.5 · CVE-2026-92081 · GHSA-4mh8-r7rc-xpvc · amended
30 Sep 2026Evidence →
Medium, CVSS 5.330 Sep 2026
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
PyPI tornado · Upgrade to 6.5.9 or later · <= 6.5.8 · CVE-2026-103261 · GHSA-3hv7-mjh2-fv65 · amended
30 Sep 2026Evidence →
High, CVSS 7.530 Sep 2026
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
PyPI tornado · Upgrade to 6.5.9 or later · <= 6.5.8 · CVE-2026-103262 · GHSA-chx6-46f5-w4vp · amended
30 Sep 2026Evidence →
High, CVSS 8.230 Sep 2026
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
PyPI tornado · Upgrade to 6.5.9 or later · <= 6.5.8 · CVE-2026-103263 · GHSA-c2m8-h5v5-343r · amended
30 Sep 2026Evidence →
Medium, CVSS 6.130 Sep 2026
GitPython submodule update path traversal can write outside the repository
PyPI gitpython · Upgrade to 3.1.62 or later · <= 3.1.61 · CVE-2026-100689 · GHSA-59cr-6r3x-644w · amended
30 Sep 2026Evidence →
Medium, CVSS 4.730 Sep 2026
hono/jsx renders plain strings unescaped in boundary components, leading to XSS
npm hono · Upgrade to 4.13.7 or later · < 4.13.7 · CVE-2026-93981 · GHSA-hxh3-vqpv-xpqv · amended
30 Sep 2026Evidence →
High, CVSS 8.130 Sep 2026
fastify vulnerable to request body replacement via an async validation result collision
npm fastify · Upgrade to 5.12.2 or later · < 5.12.2 · CVE-2026-84504 · GHSA-667r-xxjv-c9mm · amended
30 Sep 2026Evidence →
High, CVSS 7.530 Sep 2026
fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers
npm fastify · Upgrade to 5.12.2 or later · >= 4.0.0, < 5.12.2 · CVE-2026-76169 · GHSA-p68q-wchp-6fh7 · amended
30 Sep 2026Evidence →
High, CVSS 7.530 Sep 2026
fastify vulnerable to request validation bypass via skipped boolean false schemas
npm fastify · Upgrade to 5.12.2 or later · < 5.12.2 · CVE-2026-84469 · GHSA-hwr6-493r-vm6h · amended
30 Sep 2026Evidence →
High, CVSS 7.530 Sep 2026
fastify vulnerable to header validation bypass via incomplete schema case normalization
npm fastify · Upgrade to 5.12.2 or later · < 5.12.2 · CVE-2026-84428 · GHSA-9q9j-q6p8-xq58 · amended
30 Sep 2026Evidence →
Medium, CVSS 6.230 Sep 2026
pageant: Out-of-bounds read / oversized allocation in pageant MemoryMap::read via a malicious Pageant agent (Windows)
crates.io pageant · Upgrade to 0.2.3 or later · <= 0.2.2 · CVE-2026-102820 · GHSA-g4mp-vgx3-xrvm · amended
30 Sep 2026Evidence →
Medium, CVSS 6.530 Sep 2026
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
crates.io russh · Upgrade to 0.63.2 or later · <= 0.63.1 · CVE-2026-102821 · GHSA-35g8-35p8-c8fw · amended
30 Sep 2026Evidence →
Medium, CVSS 6.330 Sep 2026
Astro: Netlify Image CDN allowlist bypass enables SSRF
npm @astrojs/netlify · Upgrade to 8.2.4 or later · >= 5.2.0, <= 8.2.3 · CVE-2026-102983 · GHSA-4233-jc72-56c5 · amended
30 Sep 2026Evidence →
High, CVSS 8.230 Sep 2026
Astro: Malformed port in the Host header can crash the Node adapter
npm @astrojs/node · Upgrade to 11.1.3 or later · <= 11.1.2 · CVE-2026-102984 · GHSA-qh8j-hqjv-7m4x · amended
30 Sep 2026Evidence →
High, CVSS 7.530 Sep 2026
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing
PyPI gitpython · Upgrade to 3.1.60 or later · <= 3.1.59 · CVE-2026-87819 · GHSA-g5vv-9gxw-82hx · amended
30 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence