Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

2376–2400 of 30,910 matching · newest first

ExploitedClear filters

High, CVSS 8.231 Aug 2026
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
Packagist getkirby/cms · Upgrade to 5.5.2 or 4.9.5 by release line · <= 4.9.4; >= 5.0.0, < 5.5.2 · CVE-2026-75594 · GHSA-9vx2-j98c-p72w · amended
31 Aug 2026Evidence →
Medium, CVSS 6.631 Aug 2026
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
npm decode-uri-component · Upgrade to 0.5.0 or later · <= 0.4.2 · CVE-2026-45822 · GHSA-vcc3-ghjq-m6fr
31 Aug 2026Evidence →
High, CVSS 7.531 Aug 2026
Socket.IO: Engine.IO WebTransport SID DoS
npm engine.io · Upgrade to 6.6.7 or later · >= 6.5.0, < 6.6.7 · CVE-2026-59724 · GHSA-gr94-w7qr-f4j3
31 Aug 2026Evidence →
Medium, CVSS 5.431 Aug 2026
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
npm @hono/oauth-providers · Upgrade to 0.8.6 or later · < 0.8.6 · CVE-2026-81888 · GHSA-fm3f-ch8h-qw8q
31 Aug 2026Evidence →
High, CVSS 8.631 Aug 2026
elFinder: SSRF protection bypass via DNS rebinding in the fsock_get_contents() fallback
Packagist studio-42/elfinder · Upgrade to 2.1.70 or later · <= 2.1.69 · CVE-2026-81889 · GHSA-8x3q-jpjh-qh5c · amended
31 Aug 2026Evidence →
Medium, CVSS 6.331 Aug 2026
TYPO3 CMS - Unrestricted File Upload in Form Framework
Packagist typo3/cms-form · Upgrade to 14.3.5 or later · >= 14.2.0, <= 14.3.4 · CVE-2026-15305 · GHSA-mfqj-cqv3-h7xw · amended
31 Aug 2026Evidence →
High, CVSS 7.331 Aug 2026
zbus_polkit: authorization bypass via PID reuse
crates.io zbus_polkit · Upgrade to 5.1.0 or later · >= 0.0.0-0, < 5.1.0 · CVE-2026-78422 · amended
31 Aug 2026Evidence →
High, CVSS 8.328 Aug 2026
RestrictedPython guard hooks can be shadowed via positional-only arguments
PyPI restrictedpython · Upgrade to 8.3 or later · <= 8.2 · CVE-2026-55830 · GHSA-ffg3-p8fm-mjx2
28 Aug 2026Evidence →
Medium, CVSS 5.928 Aug 2026
org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)
Maven org.mariadb:r2dbc-mariadb · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-55860 · GHSA-c857-9x2m-cvh2 · amended
28 Aug 2026Evidence →
Medium, CVSS 5.928 Aug 2026
org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output
Maven org.mariadb:r2dbc-mariadb · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2026-55859 · GHSA-5rqc-86vf-g8r2 · amended
28 Aug 2026Evidence →
Medium, CVSS 5.928 Aug 2026
org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.9, 3.4.3, 3.3.5 or 2.7.14 by release line · < 2.7.14; >= 3.0.0, < 3.3.5; >= 3.4.0, < 3.4.3; >= 3.5.0, < 3.5.9 · CVE-2026-55858 · GHSA-xvr9-35cr-46v9 · amended
28 Aug 2026Evidence →
Medium, CVSS 5.928 Aug 2026
org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.9, 3.4.3, 3.3.5 or 2.7.14 by release line · < 2.7.14; >= 3.0.0, < 3.3.5; >= 3.4.0, < 3.4.3; >= 3.5.0, < 3.5.9 · CVE-2026-55857 · GHSA-qxvw-fvwx-5cp7 · amended
28 Aug 2026Evidence →
Medium, CVSS 5.928 Aug 2026
MariaDB has cleartext password disclosure to a MITM on the initial-handshake
Maven org.mariadb.jdbc:mariadb-java-client · Upgrade to 3.5.9, 3.4.3, 3.3.5 or 2.7.14 by release line · < 2.7.14; >= 3.0.0, < 3.3.5; >= 3.4.0, < 3.4.3; >= 3.5.0, < 3.5.9 · CVE-2026-55856 · GHSA-g9jj-cgmh-9f38 · amended
28 Aug 2026Evidence →
High, CVSS 7.028 Aug 2026
Snipe-IT has an Improper Privilege Management issue
Packagist snipe/snipe-it · Upgrade to 8.6.0 or later · < 8.6.0 · CVE-2026-55843 · GHSA-j5g3-42wp-gqm3
28 Aug 2026Evidence →
High, CVSS 8.628 Aug 2026
MapFish Print has XXE that allows reading arbitrary files of certain types
Maven org.mapfish:print.print-servlet · Upgrade to 3.28.30 or later · >= 3.0.0, < 3.28.30 · +2 more packages · CVE-2026-55848 · GHSA-5v29-34h8-v68r · amended
28 Aug 2026Evidence →
Low, CVSS 3.728 Aug 2026
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA
Go github.com/free5gc/ausf · Upgrade to 1.4.5 or later · < 1.4.5 · CVE-2026-55785 · GHSA-fp46-6vfw-gc9c · amended
28 Aug 2026Evidence →
Medium, CVSS 5.428 Aug 2026
silverstripe/versioned has XSS in archive admin restore
Packagist silverstripe/versioned · Upgrade to 3.2.1 or later · < 3.2.1 · CVE-2026-55779 · GHSA-m4g4-86qc-v8w7 · amended
28 Aug 2026Evidence →
High, CVSS 7.728 Aug 2026
SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260612000715-b44cf51fe931 (pre-release) or later · < 0.0.0-20260612000715-b44cf51fe931 · CVE-2026-55874 · GHSA-56wq-x3wv-3ff4 · amended
28 Aug 2026Evidence →
Medium, CVSS 4.328 Aug 2026
SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260614205536-b13463880c1f (pre-release) or later · >= 0.0.0-20260128085517-09bb90e8dc16, < 0.0.0-20260614205536-b13463880c1f · CVE-2026-55873 · GHSA-hgpf-8634-g44c · amended
28 Aug 2026Evidence →
Medium, CVSS 5.328 Aug 2026
Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
Maven org.graylog2:graylog2-server · Upgrade to 7.1.2, 7.0.7 or 6.3.12 by release line · >= 6.2.0, < 6.3.12; >= 7.0.0, < 7.0.7; >= 7.1.0, < 7.1.2 · CVE-2026-55867 · GHSA-j769-9gv9-65gr · amended
28 Aug 2026Evidence →
High, CVSS 7.528 Aug 2026
Fortigate syslog message parser can be exploited to modify or delete fields from the original message
Maven org.graylog2:graylog2-server · Upgrade to 7.1.2, 7.0.7 or 6.3.12 by release line · < 6.3.12; >= 7.0.0, < 7.0.7; >= 7.1.0, < 7.1.2 · CVE-2026-55841 · GHSA-gqr6-r77p-c2pj · amended
28 Aug 2026Evidence →
High, CVSS 8.728 Aug 2026
klever-go: SFT add-quantity int64 overflow bypasses a finite per-nonce MaxSupply
Go github.com/klever-io/klever-go · Upgrade to 1.7.19 or later · < 1.7.19 · CVE-2026-55764 · GHSA-mrpp-v6pg-p54x · amended
28 Aug 2026Evidence →
Medium, CVSS 5.928 Aug 2026
MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
npm mariadb · Upgrade to 3.5.3, 3.4.6, 3.3.3 or 3.2.4 by release line · < 3.2.4; >= 3.3.0, < 3.3.3; >= 3.4.0, < 3.4.6; >= 3.5.0, < 3.5.3 · CVE-2026-55854 · GHSA-42r5-vhpq-m858
28 Aug 2026Evidence →
Medium, CVSS 6.928 Aug 2026
arc has unauthenticated cluster node admission when cluster.shared_secret is unset
Go github.com/basekick-labs/arc · Upgrade to 0.0.0-20260615160325-38402ad2ebdd (pre-release) or later · < 0.0.0-20260615160325-38402ad2ebdd · CVE-2026-55678 · GHSA-p378-jp5r-gpgw · amended
28 Aug 2026Evidence →
High, CVSS 7.128 Aug 2026
Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances
Go github.com/portainer/portainer · Upgrade to 2.43.0 or 2.39.4 by release line · >= 2.39.0, < 2.39.4; >= 2.40.0, < 2.43.0 · CVE-2026-55761 · GHSA-x626-fcwx-f5pc · amended
28 Aug 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

Socket.IO: Engine.IO WebTransport SID DoS

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

TYPO3 CMS - Unrestricted File Upload in Form Framework

`zbus_polkit`: authorization bypass via PID reuse

RestrictedPython guard hooks can be shadowed via positional-only arguments

org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

MariaDB has cleartext password disclosure to a MITM on the initial-handshake

Snipe-IT has an Improper Privilege Management issue

MapFish Print has XXE that allows reading arbitrary files of certain types

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

silverstripe/versioned has XSS in archive admin restore

SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets

Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Fortigate syslog message parser can be exploited to modify or delete fields from the original message

klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset

Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized Instances

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence