Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 119 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

2251–2275 of 14,167 Critical + High advisories · newest first

Show all severities

Exploited

Critical, CVSS 9.926 Jun 2026
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
Go github.com/lxc/incus/v7/cmd/incusd · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-48749 · GHSA-2q3f-q5pq-g8wv · amended
26 Jun 2026Evidence →
High, CVSS 8.726 Jun 2026
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
Maven org.openidentityplatform.openam:openam-auth-oauth2 · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46623 · GHSA-gf57-4mp6-m85x · amended
26 Jun 2026Evidence →
High, CVSS 8.726 Jun 2026
OpenAM Authentication Bypass via MSISDN LDAP Injection
Maven org.openidentityplatform.openam:openam-auth-msisdn · Upgrade to 16.1.1 or later · < 16.1.1 · CVE-2026-46619 · GHSA-xq73-fvmr-jvmm · amended
26 Jun 2026Evidence →
High, CVSS 7.226 Jun 2026
Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in out_http
RubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44161 · GHSA-72f5-rr8c-r6gr
26 Jun 2026Evidence →
High, CVSS 7.526 Jun 2026
Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in in_http and in_forward
RubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44160 · GHSA-j9cw-hwqf-85w7
26 Jun 2026Evidence →
High, CVSS 7.526 Jun 2026
Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API
RubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44025 · GHSA-pr7j-96cj-549h
26 Jun 2026Evidence →
Critical, CVSS 9.826 Jun 2026
Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in ${tag} Placeholder
RubyGems fluentd · Upgrade to 1.19.3 or later · <= 1.19.2 · CVE-2026-44024 · GHSA-44hj-4m45-frj3
26 Jun 2026Evidence →
High, CVSS 7.326 Jun 2026
Apache Kerby has a bypass the Kerberos pre-authentication check
Maven org.apache.kerby:kerb-server · Upgrade to 2.1.2 or later · < 2.1.2 · CVE-2026-57915 · GHSA-262p-fj3f-xh7v · amended
26 Jun 2026Evidence →
Critical, CVSS 9.126 Jun 2026
Apache IoTDB has a Path Traversal vulnerability
Maven org.apache.iotdb:iotdb-server · Upgrade to 2.0.6 or 1.3.6 by release line · >= 2.0.0, < 2.0.6; >= 1.0.0, < 1.3.6 · CVE-2025-55017 · GHSA-xrvj-h9w2-3q69 · amended
26 Jun 2026Evidence →
Critical, CVSS 9.126 Jun 2026
Apache IoTDB has a Path Traversal vulnerability
Maven org.apache.iotdb:iotdb-server · Upgrade to 2.0.7 or 1.3.6 by release line · >= 1.0.0, < 1.3.6; >= 2.0.0, < 2.0.7 · CVE-2025-64152 · GHSA-h548-jhj8-q85h · amended
26 Jun 2026Evidence →
High, CVSS 7.526 Jun 2026
Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)
PyPI apache-airflow-providers-ftp · Upgrade to 3.15.1 or later · < 3.15.1 · CVE-2026-49486 · GHSA-fgch-86x8-fv43 · amended
26 Jun 2026Evidence →
High, CVSS 8.526 Jun 2026
Apicurio Registry utilities allow SSRF and denial of service through XML parsing
Maven io.apicurio:apicurio-registry-schema-util-common · Upgrade to 3.3.1 or 3.2.6 by release line · >= 3.3.0, < 3.3.1; < 3.2.6 · CVE-2026-12975 · GHSA-7g64-f2hm-vjxp · amended
26 Jun 2026Evidence →
High, CVSS 7.426 Jun 2026
Apicurio Registry allows upload of WSDL raising HTTP request
Maven io.apicurio:apicurio-registry-schema-util-wsdl · Upgrade to 3.3.1 or 3.2.6 by release line · >= 3.3.0, < 3.3.1; < 3.2.6 · CVE-2026-12992 · GHSA-rcmh-vfq7-8gf4 · amended
26 Jun 2026Evidence →
Critical, CVSS 10.025 Jun 2026
golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-46595 · GHSA-x527-x647-q7gg
25 Jun 2026Evidence →
Critical, CVSS 9.125 Jun 2026
golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-42508 · GHSA-5cgq-3rg8-m6cv
25 Jun 2026Evidence →
Critical, CVSS 9.125 Jun 2026
golang.org/x/crypto vulnerable to infinite loop on large channel writes
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39834 · GHSA-rm3j-f69w-wqmq
25 Jun 2026Evidence →
Critical, CVSS 9.125 Jun 2026
golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39831 · GHSA-89gr-r52h-f8rx
25 Jun 2026Evidence →
High, CVSS 7.525 Jun 2026
golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39829 · GHSA-w879-237q-wc7r
25 Jun 2026Evidence →
Critical, CVSS 9.125 Jun 2026
golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39830 · GHSA-vgwf-h737-ff37
25 Jun 2026Evidence →
High, CVSS 7.525 Jun 2026
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-46597 · GHSA-q4h4-gmj2-qvw2
25 Jun 2026Evidence →
Critical, CVSS 9.125 Jun 2026
golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39832 · GHSA-f5wc-c3c7-36mc
25 Jun 2026Evidence →
Critical, CVSS 9.125 Jun 2026
golang.org/x/crypto doesn't enforce invoking key constraints
Go golang.org/x/crypto · Upgrade to 0.52.0 or later · < 0.52.0 · CVE-2026-39833 · GHSA-jppx-rxg9-jmrx
25 Jun 2026Evidence →
Critical, CVSS 9.925 Jun 2026
Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise
PyPI lemur · Upgrade to 1.9.2 or later · < 1.9.2 · CVE-2026-55166 · GHSA-v2wp-frmc-5q3v · amended
25 Jun 2026Evidence →
High, CVSS 7.525 Jun 2026
ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53461 · GHSA-g22q-f7gc-5jhr
25 Jun 2026Evidence →
High, CVSS 7.525 Jun 2026
ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.14.0 or later · < 14.14.0 · CVE-2026-53460 · GHSA-q62c-h75r-2xhc
25 Jun 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image

OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

OpenAM Authentication Bypass via MSISDN LDAP Injection

Fluentd is Vulnerable to Server-Side Request Forgery (SSRF) via Placeholder Expansion in `out_http`

Fluentd is Vulnerable to Denial of Service (DoS) via Gzip Decompression Bomb in `in_http` and `in_forward`

Fluentd is Vulnerable to Exposure of Sensitive Information via Monitor Agent API

Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

Apache Kerby has a bypass the Kerberos pre-authentication check

Apache IoTDB has a Path Traversal vulnerability

Apache IoTDB has a Path Traversal vulnerability

Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)

Apicurio Registry utilities allow SSRF and denial of service through XML parsing

Apicurio Registry allows upload of WSDL raising HTTP request

golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement

golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status

golang.org/x/crypto vulnerable to infinite loop on large channel writes

golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed

golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS

golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys

golang.org/x/crypto doesn't enforce invoking key constraints

Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop

ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence