Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1526–1550 of 14,167 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 7.43 Aug 2026
undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
npm undici · Upgrade to 8.9.0 or 7.29.0 by release line · >= 7.0.0, < 7.29.0; >= 8.0.0, < 8.9.0 · CVE-2026-13697 · GHSA-4cwx-7wf7-3272
3 Aug 2026Evidence →
High, CVSS 7.53 Aug 2026
fast-uri vulnerable to host confusion via backslash authority introducer
npm fast-uri · Upgrade to 4.1.2, 3.1.5 or 2.4.4 by release line · < 2.4.4; >= 3.0.0, < 3.1.5; >= 4.0.0, < 4.1.2 · CVE-2026-18446 · GHSA-7p8r-x3mc-p8w7
3 Aug 2026Evidence →
High, CVSS 7.53 Aug 2026
Socket.IO: Zero-attachment Memory Exhaustion
npm socket.io-parser · Upgrade to 4.2.7, 3.4.5 or 3.3.6 by release line · >= 4.0.0, < 4.2.7; >= 3.4.0, < 3.4.5; < 3.3.6 · CVE-2026-69185 · GHSA-2m8v-j782-fhvr · amended
3 Aug 2026Evidence →
High, CVSS 7.53 Aug 2026
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
npm brace-expansion · Upgrade to 5.0.9, 3.0.6, 2.1.4 or 1.1.18 by release line · < 1.1.18; >= 2.0.0, < 2.1.4; >= 3.0.0, < 3.0.6; >= 4.0.0, < 5.0.9 · CVE-2026-69152 · GHSA-rgw5-rvv9-x895
3 Aug 2026Evidence →
High, CVSS 7.63 Aug 2026
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
npm @angular/compiler +1 · Upgrade all 2 to 22.0.1, 21.2.19 or 20.3.27 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.1; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25 · CVE-2026-69151 · GHSA-jj27-h5hq-8x99
3 Aug 2026Evidence →
High, CVSS 8.63 Aug 2026
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
npm @angular/platform-server · Upgrade to 22.0.7, 21.2.19 or 20.3.27 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.7; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25 · CVE-2026-69149 · GHSA-vpx6-8pjr-4g3v
3 Aug 2026Evidence →
High, CVSS 8.83 Aug 2026
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
npm @angular/common · Upgrade to 22.0.2, 21.2.19 or 20.3.27 by release line; some affected versions have no fix yet · >= 22.0.0-next.0, < 22.0.2; >= 21.0.0-next.0, < 21.2.19; >= 20.0.0-next.0, < 20.3.27; <= 19.2.25 · CVE-2026-68945 · GHSA-jhpw-976m-542j
3 Aug 2026Evidence →
High, CVSS 8.23 Aug 2026
Auto-Reseeding HMAC-DRBG could panic for some output lengths
crates.io libcrux-hmac-drbg · Upgrade to 0.0.2 or later · >= 0.0.0-0, < 0.0.2 · amended
3 Aug 2026Evidence →
High, CVSS 8.73 Aug 2026
Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guard
Maven org.bouncycastle:bc-fips · Upgrade to 2.1.3, 2.0.2 or 1.0.2.7 by release line · < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3 · +3 more packages · CVE-2026-13506 · GHSA-qp49-qgx5-5m26 · amended
3 Aug 2026Evidence →
Critical, CVSS 9.33 Aug 2026
Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URI
Maven org.bouncycastle:bc-fips · Upgrade to 2.1.3, 2.0.2 or 1.0.2.7 by release line · < 1.0.2.7; >= 2.0.0, < 2.0.2; >= 2.1.0, < 2.1.3 · +3 more packages · CVE-2026-8763 · GHSA-9pwp-9qqc-pr26 · amended
3 Aug 2026Evidence →
High, CVSS 7.12 Aug 2026
Transformers save_pretrained path traversal allows arbitrary file writes through chat template names
PyPI transformers · Upgrade to 5.10.0 or later · < 5.10.0 · CVE-2026-9856 · GHSA-xrqw-3rrv-vx5w
2 Aug 2026Evidence →
High, CVSS 7.51 Aug 2026
Processing of unverified relay events
crates.io nostr-relay-pool · Upgrade to 0.44.3 or later · >= 0.0.0-0, < 0.44.3
1 Aug 2026Evidence →
High, CVSS 7.51 Aug 2026
Empty NIP-50 search filters can panic
crates.io nostr · Upgrade to 0.44.7 or later · >= 0.0.0-0, < 0.44.7
1 Aug 2026Evidence →
High, CVSS 7.51 Aug 2026
NIP-44 v2 decryption permits resource exhaustion
crates.io nostr · Upgrade to 0.44.7 or later · >= 0.0.0-0, < 0.44.7
1 Aug 2026Evidence →
High, CVSS 7.51 Aug 2026
Wallet event parsers accept unauthenticated events
crates.io nostr · Upgrade to 0.44.7 or later · >= 0.0.0-0, < 0.44.7
1 Aug 2026Evidence →
High, CVSS 7.51 Aug 2026
Verification cache poisoning allows forged Nostr events to bypass signature validation
crates.io nostr-relay-pool · Upgrade to 0.44.2 or later · >= 0.0.0-0, < 0.44.2 · GHSA-f96q-5f6p-v7cj
1 Aug 2026Evidence →
High, CVSS 7.51 Aug 2026
Relay authentication challenges can exhaust memory
crates.io nostr-relay-pool · Upgrade to 0.44.3 or later · >= 0.0.0-0, < 0.44.3
1 Aug 2026Evidence →
High, CVSS 7.51 Aug 2026
NIP-98 authorization parsing permits resource exhaustion
crates.io nostr · Upgrade to 0.44.7 or later · >= 0.0.0-0, < 0.44.7
1 Aug 2026Evidence →
High, CVSS 7.731 Jul 2026
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
Go github.com/gtsteffaniak/filebrowser/backend · Upgrade to 0.0.0-20260608182036-f3f4bbe80cb5 (pre-release) or later · < 0.0.0-20260608182036-f3f4bbe80cb5 · CVE-2026-54910 · GHSA-vvp7-h4fj-m28w · amended
31 Jul 2026Evidence →
High, CVSS 8.731 Jul 2026
@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag
npm @apostrophecms/seo · Upgrade to 1.5.0 or later · <= 1.4.2 · CVE-2026-53608 · GHSA-wf43-fpp3-cf65
31 Jul 2026Evidence →
Critical, CVSS 9.131 Jul 2026
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass
npm apostrophe · Upgrade to 4.31.0 or later · <= 4.30.0 · CVE-2026-53609 · GHSA-6h5j-32cf-4253 · amended
31 Jul 2026Evidence →
Critical, CVSS 9.331 Jul 2026
sentence-transformers local model loading bypasses trust_remote_code and executes custom Python
PyPI sentence-transformers · Upgrade to 5.6.0 or later · < 5.6.0 · CVE-2026-68770 · GHSA-jhr6-gm9c-rqjv · amended
31 Jul 2026Evidence →
Critical, CVSS 10.031 Jul 2026
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE
npm @nocobase/plugin-notification-in-app-message · Upgrade to 2.0.61 or later · <= 2.0.60 · CVE-2026-52887 · GHSA-p849-8hwh-84j9 · amended
31 Jul 2026Evidence →
High, CVSS 7.531 Jul 2026
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
Packagist redaxo/source · Upgrade to 5.21.1 or later · >= 5.18.2, < 5.21.1 · CVE-2026-53599 · GHSA-98pp-vccm-qm25 · amended
31 Jul 2026Evidence →
High, CVSS 8.131 Jul 2026
Savon::Model evaluates WSDL operation names as Ruby source
RubyGems savon · Upgrade to 2.17.2 or later · >= 0.9.8, < 2.17.2 · CVE-2026-53510 · GHSA-mx5j-mp4f-g8jg · amended
31 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence