Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
Critical: 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

151–175 of 30,910 matching · newest first

ExploitedClear filters

Medium, CVSS 5.06 Nov 2026
LXD: SSRF via image import from URL allows internal network probing by authenticated users
Go github.com/canonical/lxd · Upgrade to 0.0.0-20261005133302-c4a919f3f4e2 (pre-release) or later · < 0.0.0-20261005133302-c4a919f3f4e2 · CVE-2026-28385 · GHSA-3gq2-x4qg-p4g6 · amended
6 Nov 2026Evidence →
Medium, CVSS 5.56 Nov 2026
listmonk: SQL Injection in /api/subscribers/export bypasses table access control, leaking admin password hashes and SMTP credentials
Go github.com/knadh/listmonk · Upgrade to 1.1.1-0.20260619102436-c0a6525009a6 (pre-release) or later · < 1.1.1-0.20260619102436-c0a6525009a6 · CVE-2026-62361 · GHSA-xgjr-7j9q-2h4r · amended
6 Nov 2026Evidence →
High, CVSS 8.66 Nov 2026
OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
Go github.com/osac-project/osac-operator · Upgrade to 0.0.4 or later · < 0.0.4 · CVE-2026-62284 · GHSA-5w5g-j6hw-6p8f · amended
6 Nov 2026Evidence →
Medium, CVSS 4.36 Nov 2026
Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration
Maven org.eclipse.hawkbit:hawkbit-ddi-resource · Upgrade to 1.0.4 or later · < 1.0.4 · CVE-2026-16454 · GHSA-92r3-p8c2-3fpx · amended
6 Nov 2026Evidence →
Unrated6 Nov 2026
Large-window Brotli bodies bypass decompression memory limits
crates.io actix-http · Upgrade to 3.20.3 or later · >= 0.0.0-0, < 3.20.3 · GHSA-7p9w-p5qm-5gc5
6 Nov 2026Evidence →
Unrated6 Nov 2026
Compressed request bodies can exhaust memory before extractor limits apply
crates.io actix-http · Upgrade to 3.20.1 or later · >= 0.0.0-0, < 3.20.1 · +1 more package · GHSA-qph8-7859-gq2f · amended
6 Nov 2026Evidence →
Unrated6 Nov 2026
Hidden file disclosure through Windows short names
crates.io actix-files · Upgrade to 0.7.4 or later · >= 0.0.0-0, < 0.7.4 · GHSA-8hcm-m7r7-frwc
6 Nov 2026Evidence →
Unrated6 Nov 2026
Degraded secret zeroization capabilities
crates.io vodozemac · Upgrade to 0.11.2 or later · >= 0.11.0, < 0.11.2 · GHSA-mxcm-mrw6-c446
6 Nov 2026Evidence →
Unrated6 Nov 2026
Request smuggling through malformed chunked request trailers
crates.io actix-http · Upgrade to 3.20.2 or later · >= 0.0.0-0, < 3.20.2 · GHSA-2q7f-mf9f-5qhr
6 Nov 2026Evidence →
Unrated6 Nov 2026
Degraded secret zeroization capabilities
crates.io vodozemac · Upgrade to 0.11.2 or later · >= 0.0.0-0, < 0.11.2 · GHSA-v27v-f96q-qhjq
6 Nov 2026Evidence →
Unrated5 Nov 2026
Event type spoofing via UntrustedType in github.com/google/go-eventlog
Go github.com/google/go-eventlog · Upgrade to 0.0.3-0.20261001001437-1991f15bc4b0 (pre-release) or later · < 0.0.3-0.20261001001437-1991f15bc4b0
5 Nov 2026Evidence →
Medium, CVSS 6.55 Nov 2026
filecoin-pin: Unbounded DAG pinning can exhaust server resources
npm filecoin-pin · Upgrade to 1.1.1 or later · < 1.1.1 · CVE-2026-62300 · GHSA-m5ph-mmg5-6w5h · amended
5 Nov 2026Evidence →
High, CVSS 7.55 Nov 2026
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
PyPI banks · Upgrade to 2.4.3 or later · < 2.4.3 · CVE-2026-61536 · GHSA-64vx-6h2c-rjh7 · amended
5 Nov 2026Evidence →
Critical, CVSS 9.35 Nov 2026
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
Go github.com/chainguard-dev/kaniko · Upgrade to 1.25.20 or later · < 1.25.20 · CVE-2026-105769 · GHSA-5q7h-w9jf-cx97 · amended
5 Nov 2026Evidence →
High, CVSS 8.45 Nov 2026
lxd allows Cross-guest volume hijack via DevLXD device patch
Go github.com/canonical/lxd · Upgrade to 0.0.0-20260626085133-7cb96ac80a6d (pre-release) or later · >= 0.0.0-20250721152936-fe86ceb2c3fa, < 0.0.0-20260626085133-7cb96ac80a6d · CVE-2026-12411 · GHSA-hhf9-qw4v-72xp · amended
5 Nov 2026Evidence →
Medium, CVSS 6.55 Nov 2026
Unbounded response body buffering in Streamable HTTP clients
crates.io rmcp · Upgrade to 3.9.0 or later · >= 0.2.0, < 3.9.0 · GHSA-c9f9-cp8h-jcj5
5 Nov 2026Evidence →
Medium, CVSS 6.54 Nov 2026
Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735
Go github.com/basekick-labs/arc · Upgrade to 0.0.0-20260610131716-5dc8f53b70a3 (pre-release) or later · < 0.0.0-20260610131716-5dc8f53b70a3 · CVE-2026-55098 · GHSA-93cm-2v4m-c56c · amended
4 Nov 2026Evidence →
Medium, CVSS 5.34 Nov 2026
@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter
npm @payloadcms/storage-vercel-blob · Upgrade to 4.0.0-canary.34 (pre-release) or 3.90.0 by release line · >= 3.25.0, < 3.90.0; >= 4.0.0-canary.0, < 4.0.0-canary.34 · CVE-2026-93363 · GHSA-mc8m-rr6c-r5qr · amended
4 Nov 2026Evidence →
Medium, CVSS 6.14 Nov 2026
odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values
npm odf-kit · Upgrade to 0.14.2 or later · >= 0.6.0, < 0.14.2 · CVE-2026-113787 · GHSA-3cgg-c5pp-57h6 · amended
4 Nov 2026Evidence →
Medium, CVSS 6.54 Nov 2026
Memory exhaustion when parsing a crafted iloc box
crates.io heifer-isobmff · Upgrade to 0.3.27 or later · >= 0.0.0-0, < 0.3.27 · GHSA-3243-948x-x627
4 Nov 2026Evidence →
Medium, CVSS 6.54 Nov 2026
Panic on an HEVC tile layout that does not match the active SPS
crates.io heifer-hevc-dec · Upgrade to 0.3.27 or later · >= 0.0.0-0, < 0.3.27 · GHSA-rcff-5x58-7w2p
4 Nov 2026Evidence →
Medium, CVSS 6.54 Nov 2026
Panic on chroma QP offsets enabled with an empty offset list
crates.io heifer-hevc-dec · Upgrade to 0.3.27 or later · >= 0.0.0-0, < 0.3.27 · GHSA-rmc9-8qp4-gjhx
4 Nov 2026Evidence →
High, CVSS 7.83 Nov 2026
Stanza: RCE via pickle deserialization in the lemmatizer
PyPI stanza · Upgrade to 1.15.0 or later · >= 1.14.0, < 1.15.0 · CVE-2026-115878 · GHSA-gh9r-c94j-cmp5 · amended
3 Nov 2026Evidence →
Critical, CVSS 9.83 Nov 2026
Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered .constructor member access
npm @enspirit/elo · Upgrade to 1.0.1 or later · < 1.0.1 · CVE-2026-44267 · GHSA-33r5-xmm8-v6x5 · amended
3 Nov 2026Evidence →
Critical, CVSS 9.83 Nov 2026
Elo Ruby backend has Remote Code Execution via unescaped #{...} interpolation in emitted string literals and subtype-constraint labels
npm @enspirit/elo · Upgrade to 1.0.1 or later · < 1.0.1 · CVE-2026-44266 · GHSA-7w38-ggh5-v542 · amended
3 Nov 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

LXD: SSRF via image import from URL allows internal network probing by authenticated users

listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy

Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration

Large-window Brotli bodies bypass decompression memory limits

Compressed request bodies can exhaust memory before extractor limits apply

Hidden file disclosure through Windows short names

Degraded secret zeroization capabilities

Request smuggling through malformed chunked request trailers

Degraded secret zeroization capabilities

Event type spoofing via UntrustedType in github.com/google/go-eventlog

filecoin-pin: Unbounded DAG pinning can exhaust server resources

Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

lxd allows Cross-guest volume hijack via DevLXD device patch

Unbounded response body buffering in Streamable HTTP clients

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter

odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values

Memory exhaustion when parsing a crafted `iloc` box

Panic on an HEVC tile layout that does not match the active SPS

Panic on chroma QP offsets enabled with an empty offset list

Stanza: RCE via pickle deserialization in the lemmatizer

Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence