Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

1751–1775 of 14,167 Critical + High advisories · newest first

Show all severities

Exploited

High, CVSS 7.522 Jul 2026
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-55833 · GHSA-mvh2-crg5-v77c
22 Jul 2026Evidence →
High, CVSS 7.522 Jul 2026
Netty SPDY SETTINGS frame count materializes unbounded settings map
Maven io.netty:netty-codec-http · Upgrade to 4.2.16.Final or 4.1.136.Final by release line · >= 4.2.0.Final, <= 4.2.15.Final; >= 4.1.0.Final, <= 4.1.135.Final · CVE-2026-55831 · GHSA-6jqx-86gh-f27w
22 Jul 2026Evidence →
High, CVSS 8.422 Jul 2026
n8n: Stored DOM XSS via Resource Locator cachedResultUrl
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65592 · GHSA-9wcp-9r3j-383q · amended
22 Jul 2026Evidence →
High, CVSS 8.222 Jul 2026
n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65597 · GHSA-p3rg-hrf9-w9gj · amended
22 Jul 2026Evidence →
High, CVSS 8.922 Jul 2026
n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
npm n8n · Upgrade to 2.30.1, 2.29.8 or 1.123.64 by release line · < 1.123.64; >= 2.30.0, < 2.30.1; >= 2.0.0-rc.0, < 2.29.8 · CVE-2026-65598 · GHSA-g3r5-9h93-4j2c · amended
22 Jul 2026Evidence →
High, CVSS 7.222 Jul 2026
n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
npm n8n · Upgrade to 2.30.1 or 2.29.8 by release line · >= 2.30.0, < 2.30.1; < 2.29.8 · CVE-2026-65015 · GHSA-x5vx-c2c8-m3w9 · amended
22 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
fast-uri vulnerable to host confusion via literal backslash authority delimiter
npm fast-uri · Upgrade to 4.1.1, 3.1.4 or 2.4.3 by release line · >= 2.3.1, <= 2.4.2; >= 3.0.0, <= 3.1.3; >= 4.0.0, <= 4.1.0 · CVE-2026-16221 · GHSA-v2hh-gcrm-f6hx · amended
21 Jul 2026Evidence →
High, CVSS 7.021 Jul 2026
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
npm sharp · Upgrade to 0.35.0 or later · < 0.35.0 · CVE-2026-114113 · GHSA-f88m-g3jw-g9cj · amended
21 Jul 2026Evidence →
High, CVSS 8.721 Jul 2026
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
npm fast-xml-parser · Upgrade to 5.10.1 or later · >= 5.9.3, < 5.10.1 · CVE-2026-73569 · GHSA-8r6m-32jq-jx6q · amended
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
PyPI gitpython · Upgrade to 3.1.52 or later · < 3.1.52 · CVE-2026-67322 · GHSA-rwj8-pgh3-r573 · amended
21 Jul 2026Evidence →
High, CVSS 8.721 Jul 2026
jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
Maven com.fasterxml.jackson.core:jackson-core · Upgrade to 2.21.4 or 2.18.8 by release line · < 2.18.8; >= 2.19.0, < 2.21.4 · +1 more package · CVE-2026-68494 · GHSA-r7wm-3cxj-wff9
21 Jul 2026Evidence →
High, CVSS 7.121 Jul 2026
Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · >= 1.5.0, < 1.26.3 · CVE-2026-20779 · GHSA-gx3v-q759-g323
21 Jul 2026Evidence →
High, CVSS 7.621 Jul 2026
Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts
Go code.gitea.io/gitea · Upgrade to 1.26.4 or later · < 1.26.4 · CVE-2026-58422 · GHSA-g9g6-qhrc-p3qc
21 Jul 2026Evidence →
High, CVSS 8.821 Jul 2026
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-27775 · GHSA-649p-mmhf-85c7
21 Jul 2026Evidence →
High, CVSS 7.721 Jul 2026
Gitea: Two SSRF findings
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58314 · GHSA-2fcr-jfvc-vgg2
21 Jul 2026Evidence →
High, CVSS 8.721 Jul 2026
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58436 · GHSA-fw57-jgch-pgf3
21 Jul 2026Evidence →
High, CVSS 7.121 Jul 2026
Gitea: Repository Visibility Manipulation via Git Push Options
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58437 · GHSA-8p9h-49rc-qgxj
21 Jul 2026Evidence →
High, CVSS 8.121 Jul 2026
Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-55987 · GHSA-vrhc-jjfc-m3m3
21 Jul 2026Evidence →
High, CVSS 7.521 Jul 2026
Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-54481 · GHSA-94v3-77j7-vm48
21 Jul 2026Evidence →
Critical, CVSS 9.621 Jul 2026
Gitea: Public-only repository tokens can update private PR head branches
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-58443 · GHSA-xxjv-752h-3vp2
21 Jul 2026Evidence →
High, CVSS 8.921 Jul 2026
Gitea: Permanent Fork PR Workflow Approval Gate Bypass
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-58424 · GHSA-777r-4v59-6486
21 Jul 2026Evidence →
High, CVSS 7.721 Jul 2026
Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · >= 1.23.0, < 1.26.3 · CVE-2026-58423 · GHSA-7wvc-rvp7-w99x
21 Jul 2026Evidence →
Critical, CVSS 9.821 Jul 2026
Gitea Docker image: REVERSE_PROXY_TRUSTED_PROXIES = * default lets any source IP impersonate any user via X-WEBAUTH-USER
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-20896 · GHSA-f75j-4cw6-rmx4
21 Jul 2026Evidence →
Critical, CVSS 9.621 Jul 2026
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
Go code.gitea.io/gitea · Upgrade to 1.26.3 or later · < 1.26.3 · CVE-2026-22874 · GHSA-2r5c-gw76-rh3w
21 Jul 2026Evidence →
High, CVSS 8.721 Jul 2026
Gitea: Privilege Escalation via Access Token Scope Escalation in API
Go code.gitea.io/gitea · Upgrade to 1.27.0 or later · < 1.27.0 · CVE-2026-56654 · GHSA-683j-3ff6-hh2x
21 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty SPDY SETTINGS frame count materializes unbounded settings map

n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution

n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool

fast-uri vulnerable to host confusion via literal backslash authority delimiter

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Gitea: Two SSRF findings

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Gitea: Repository Visibility Manipulation via Git Push Options

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Gitea: Public-only repository tokens can update private PR head branches

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Gitea: Privilege Escalation via Access Token Scope Escalation in API

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence