Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1701–1725 of 30,910 matching · newest first

ExploitedClear filters

Low, CVSS 1.024 Sep 2026
Dynamic record lifting can allocate beyond the hostcall fuel limit
crates.io wasmtime · Upgrade to 49.0.1, 48.0.3 or 36.0.16 by release line · >= 0.0.0-0, < 36.0.16; >= 37.0.0, < 48.0.3; >= 49.0.0, < 49.0.1 · CVE-2026-115389 · GHSA-jqpg-j7w6-42pr · amended
24 Sep 2026Evidence →
Unrated24 Sep 2026
PHP CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison
Bitnami php +3 · Upgrade all 4 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-91768 · GHSA-62xp-839h-2637 · amended
24 Sep 2026Evidence →
Unrated24 Sep 2026
PHP CVE-2026-92842: Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL
Bitnami php +3 · Upgrade all 4 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-92842 · GHSA-88hq-2827-7pg6 · amended
24 Sep 2026Evidence →
Unrated24 Sep 2026
PHP CVE-2026-91767: Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN
Bitnami php +3 · Upgrade all 4 to 8.5.11, 8.4.26, 8.3.35 or 8.2.34 by release line · >= 8.2.0, < 8.2.34; >= 8.3.0, < 8.3.35; >= 8.4.0, < 8.4.26; >= 8.5.0, < 8.5.11 · CVE-2026-91767 · GHSA-xr7j-rvgx-xq5p · amended
24 Sep 2026Evidence →
High, CVSS 7.523 Sep 2026
elysia has Inefficient Algorithmic Complexity and Interpretation Conflict
npm elysia · Upgrade to 1.4.29 or later · < 1.4.29 · CVE-2026-56669 · GHSA-9643-4qgh-g8mx · amended
23 Sep 2026Evidence →
High, CVSS 7.523 Sep 2026
ReactPress has SQL injection via dynamic column names in TypeORM query builders
npm @fecommunity/reactpress · Upgrade to 3.7.0 or later · <= 3.6.0 · CVE-2026-61685 · GHSA-wmw4-mw6x-6vfm · amended
23 Sep 2026Evidence →
Medium, CVSS 6.523 Sep 2026
plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length
PyPI plone-app-contenttypes · Upgrade to 5.0.1, 4.0.10 or 3.0.12 by release line · >= 5.0.0, <= 5.0.0; >= 4.0.0, <= 4.0.9; <= 3.0.11 · GHSA-8pcw-h6w9-h46g · amended
23 Sep 2026Evidence →
Medium, CVSS 6.523 Sep 2026
plone.app.dexterity has a Denial of Service due to excessive title or description length
PyPI plone-app-dexterity · Upgrade to 5.0.1, 4.1.3 or 3.2.3 by release line · >= 5.0.0, <= 5.0.0; >= 4.0.0, <= 4.1.2; <= 3.2.2 · CVE-2026-57576 · GHSA-5426-92w4-wvhv · amended
23 Sep 2026Evidence →
High, CVSS 7.623 Sep 2026
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
npm @openc3/vue-common · Upgrade to 7.3.0 or later · >= 5.0.6, <= 7.2.1 · CVE-2026-77394 · GHSA-gvf2-2rh5-mpgf · amended
23 Sep 2026Evidence →
High, CVSS 7.023 Sep 2026
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82407 · GHSA-9wh6-9hq7-9688 · amended
23 Sep 2026Evidence →
High, CVSS 8.423 Sep 2026
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82409 · GHSA-7c7c-373r-gfjj · amended
23 Sep 2026Evidence →
High, CVSS 7.123 Sep 2026
Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplace
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82406 · GHSA-26r5-4mm2-px5c · amended
23 Sep 2026Evidence →
High, CVSS 7.723 Sep 2026
Formie: Missing authorization on sent notification resend modal exposes submission PII
Packagist verbb/formie · Upgrade to 3.1.31 or 2.2.23 by release line · >= 3.0.0, < 3.1.31; < 2.2.23 · CVE-2026-76089 · GHSA-9rg8-2wvr-fgjh · amended
23 Sep 2026Evidence →
High, CVSS 7.523 Sep 2026
Jawn: Quadratic parsing effort in AsyncParser
Maven org.typelevel:jawn-parser_2.13 +2 · Upgrade all 3 to 1.7.0 or later · <= 1.6.0 · CVE-2026-61814 · GHSA-w4cm-gvhj-cgw6 · amended
23 Sep 2026Evidence →
High, CVSS 7.523 Sep 2026
Jawn: Uncontrolled nesting depth in JSON parser
Maven org.typelevel:jawn-parser_2.13 +2 · Upgrade all 3 to 1.7.0 or later · <= 1.6.0 · CVE-2026-59990 · GHSA-cc4v-rvgp-2pf3 · amended
23 Sep 2026Evidence →
High, CVSS 8.723 Sep 2026
Klever-Go Account takeover: kleverUpdateAccountPermission authorizes on attacker-controlled RecipientAddr instead of the authenticated caller
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-82405 · GHSA-97cv-x867-6xhm · amended
23 Sep 2026Evidence →
High, CVSS 7.523 Sep 2026
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · < 1.7.20 · CVE-2026-86065 · GHSA-4fwh-wrm6-97xm · amended
23 Sep 2026Evidence →
High, CVSS 8.623 Sep 2026
Klever-Go: /log controls global node logging
Go github.com/klever-io/klever-go · Upgrade to 1.7.20 or later · <= 1.7.19 · CVE-2026-86064 · GHSA-9v8p-frvj-2pcm · amended
23 Sep 2026Evidence →
Medium, CVSS 5.323 Sep 2026
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
PyPI mesop · Upgrade to 1.3.4 or later · <= 1.3.3 · CVE-2026-93421 · GHSA-g7f6-rxc4-qhph · amended
23 Sep 2026Evidence →
Critical, CVSS 9.923 Sep 2026
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
RubyGems openc3 · Upgrade to 7.3.0 or later · >= 5.1.0, <= 7.2.1 · CVE-2026-77602 · GHSA-jjq7-m736-w977 · amended
23 Sep 2026Evidence →
High, CVSS 8.823 Sep 2026
OpenC3 COSMOS: Authenticated OS command injection via the pypi_url setting
RubyGems openc3 · Upgrade to 7.3.0 or later · >= 5.12.0, <= 7.2.1 · CVE-2026-77601 · GHSA-vp3w-52v9-q57f · amended
23 Sep 2026Evidence →
High, CVSS 8.223 Sep 2026
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
Packagist verbb/formie · Upgrade to 3.1.31 or 2.2.23 by release line · >= 3.0.0, < 3.1.31; < 2.2.23 · CVE-2026-76087 · GHSA-584p-f93j-wpgc · amended
23 Sep 2026Evidence →
High, CVSS 8.523 Sep 2026
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
Packagist verbb/formie · Upgrade to 3.1.31 or 2.2.23 by release line · >= 3.0.0, < 3.1.31; < 2.2.23 · CVE-2026-76086 · GHSA-v3f3-cmj4-cvj9 · amended
23 Sep 2026Evidence →
Medium, CVSS 6.923 Sep 2026
Sulu: JCR-SQL2 injection via categories query parameter (unauthenticated)
Packagist sulu/sulu · Upgrade to 3.0.8 or 2.6.25 by release line · < 2.6.25; >= 3.0.0, < 3.0.8 · CVE-2026-92692 · GHSA-jg26-q8hg-3pq4 · amended
23 Sep 2026Evidence →
Medium, CVSS 6.523 Sep 2026
JLine: ReDoS in Nano Editor Regex Search Mode
Maven org.jline:jline-builtins · Upgrade to 4.3.1 or 3.30.15 by release line · >= 4.0.0, < 4.3.1; >= 3.0.0, < 3.30.15 · CVE-2026-77421 · GHSA-ph9c-7hw9-vhhw · amended
23 Sep 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Dynamic record lifting can allocate beyond the hostcall fuel limit

PHP CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison

PHP CVE-2026-92842: Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL

PHP CVE-2026-91767: Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

ReactPress has SQL injection via dynamic column names in TypeORM query builders

plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length

plone.app.dexterity has a Denial of Service due to excessive title or description length

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Formie: Missing authorization on sent notification resend modal exposes submission PII

Jawn: Quadratic parsing effort in AsyncParser

Jawn: Uncontrolled nesting depth in JSON parser

Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

Klever-Go: /log controls global node logging

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Formie: Unauthenticated users can overwrite incomplete submissions via submit action

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

JLine: ReDoS in Nano Editor Regex Search Mode

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence