Know what to patch next.

Published open-source security advisories, matched to the exact versions you run.

Run in a terminal

$ claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext

Your browser opens: sign in and choose what the agent may read.

Then ask: What do I need to patch on this machine?

New: 941 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
Critical: 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.

Exploited: 132 All actionable advisories, of any publish date, that CISA's Known Exploited Vulnerabilities catalog confirms are exploited in the wild, within the selected severities. Show them in the feed.

Advisories per daypartial

Actionable

2451–2475 of 30,910 matching · newest first

ExploitedClear filters

Medium, CVSS 4.328 Aug 2026
Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55547 · GHSA-cvw4-55pp-3hfq · amended
28 Aug 2026Evidence →
Medium, CVSS 6.528 Aug 2026
Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · <= 5.12.7; >= 5.13.0, <= 5.13.1 · CVE-2026-55545 · GHSA-fwww-cp23-7f5g · amended
28 Aug 2026Evidence →
High, CVSS 8.828 Aug 2026
Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55521 · GHSA-962x-ccwf-8x6p · amended
28 Aug 2026Evidence →
Critical, CVSS 9.128 Aug 2026
Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs executeSql
Maven org.yamcs:yamcs-core · Upgrade to 5.13.2 or 5.12.8 by release line · >= 5.13.0, <= 5.13.1; <= 5.12.7 · CVE-2026-55511 · GHSA-3g44-3m7x-cgg2 · amended
28 Aug 2026Evidence →
Critical, CVSS 9.328 Aug 2026
free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints
Go github.com/free5gc/free5gc · Upgrade to 4.2.2 or later · < 4.2.2 · CVE-2026-55068 · GHSA-x8mj-6p3q-g5pp · amended
28 Aug 2026Evidence →
Medium, CVSS 5.028 Aug 2026
Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via project_view_id mass-assignment
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-55067 · GHSA-569v-q83c-3j3g · amended
28 Aug 2026Evidence →
High, CVSS 7.128 Aug 2026
Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · <= 2.3.0 · CVE-2026-55066 · GHSA-5pg6-m483-7vrg · amended
28 Aug 2026Evidence →
High, CVSS 8.128 Aug 2026
Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 0.24.6, < 2.4.0 · CVE-2026-55065 · GHSA-gg93-x632-9ccv · amended
28 Aug 2026Evidence →
Medium, CVSS 4.328 Aug 2026
Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 2.3.0, < 2.4.0 · CVE-2026-55064 · GHSA-44v6-7fxq-vgf4 · amended
28 Aug 2026Evidence →
Medium, CVSS 5.328 Aug 2026
Vikunja has a project duplication bypasses write-permission check on the target parent project
Go code.vikunja.io/api · Upgrade to 2.4.0 or later · >= 0.21.0, <= 2.3.0 · CVE-2026-54766 · GHSA-f27p-pw2p-9pr4 · amended
28 Aug 2026Evidence →
High, CVSS 7.528 Aug 2026
datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS
crates.io datadog-opentelemetry · Upgrade to 0.3.3 or later · >= 0.1.0, < 0.3.3 · CVE-2026-54788 · GHSA-gpwf-4h98-v82q · amended
28 Aug 2026Evidence →
Medium, CVSS 4.328 Aug 2026
Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none
Go github.com/pocket-id/pocket-id/backend · Upgrade to 2.9.0 or later · >= 2.6.0, <= 2.8.0 · CVE-2026-55834 · GHSA-2wvm-8mvp-22qv · amended
28 Aug 2026Evidence →
Critical, CVSS 9.628 Aug 2026
Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)
Go github.com/klever-io/klever-go · Upgrade to 1.7.19 or later · < 1.7.19 · CVE-2026-54755 · GHSA-cgc5-v3f2-8m2v · amended
28 Aug 2026Evidence →
Critical, CVSS 9.628 Aug 2026
Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
Go github.com/klever-io/klever-go · Upgrade to 1.7.19 or later · < 1.7.19 · CVE-2026-54754 · GHSA-p7gw-2pcp-5pf8 · amended
28 Aug 2026Evidence →
High, CVSS 7.828 Aug 2026
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
PyPI compliance-trestle · Upgrade to 4.1.0 or 3.12.4 by release line · <= 3.12.3; >= 4.0.0, < 4.1.0 · CVE-2026-54757 · GHSA-jw39-3688-r4rx
28 Aug 2026Evidence →
High, CVSS 8.528 Aug 2026
KubeVela Terraform remote loader DoS via unbounded file read
Go github.com/oam-dev/kubevela · Upgrade to 1.11.0-alpha.4 (pre-release), 1.10.9 or 1.9.14 by release line · < 1.9.14; >= 1.10.0-alpha.1, < 1.10.9; >= 1.11.0-alpha.1, < 1.11.0-alpha.4 · CVE-2026-55108 · GHSA-fmgp-q6jx-gg3x · amended
28 Aug 2026Evidence →
Medium, CVSS 6.528 Aug 2026
gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)
crates.io gix-packetline · Upgrade to 0.21.5 or later · <= 0.21.4 · CVE-2026-82250 · GHSA-2vh6-hw4j-32ww · amended
28 Aug 2026Evidence →
Medium, CVSS 6.428 Aug 2026
Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe
Go github.com/hatchet-dev/hatchet · Upgrade to 0.91.2 or later · >= 0.40.0, < 0.91.2 · CVE-2026-54746 · GHSA-8x7x-83cf-c3pg · amended
28 Aug 2026Evidence →
High, CVSS 8.728 Aug 2026
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
Packagist phalcon/cphalcon · Upgrade to 5.15.0 or later · <= 5.14.2 · CVE-2026-57584 · GHSA-x7rj-f32v-7jjg · amended
28 Aug 2026Evidence →
High, CVSS 8.228 Aug 2026
Phalcon: Non-constant-time HMAC verification in Encryption\Crypt::decrypt (timing side-channel)
Packagist phalcon/cphalcon · Upgrade to 5.14.1 or later · <= 5.14.0 · CVE-2026-54736 · GHSA-8jqh-95g6-7jpj · amended
28 Aug 2026Evidence →
Unrated28 Aug 2026
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
Go golang.org/x/crypto · Upgrade to 0.55.0 or later · < 0.55.0 · CVE-2026-56854
28 Aug 2026Evidence →
Medium, CVSS 5.927 Aug 2026
aiosmtplib: STARTTLS response injection
PyPI aiosmtplib · Upgrade to 5.1.2 or later · <= 5.1.1 · CVE-2026-55558 · GHSA-vxj7-4xrp-5vr4
27 Aug 2026Evidence →
Medium, CVSS 6.127 Aug 2026
WebOb: Open redirect in Location header normalization via leading C0 control / space characters
PyPI webob · Upgrade to 1.8.11 or later · < 1.8.11 · CVE-2026-54770 · GHSA-6hx8-3wjj-gr8g
27 Aug 2026Evidence →
Critical, CVSS 9.827 Aug 2026
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
PyPI litellm · Upgrade to 1.83.7 or later · < 1.83.7 · CVE-2026-37004 · GHSA-6wvf-77m9-58rm · amended
27 Aug 2026Evidence →
High, CVSS 8.227 Aug 2026
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check
Go github.com/crossplane/crossplane-runtime/v2 · Upgrade to 2.4.0-rc.1 (pre-release) or 2.3.3 by release line · >= 2.4.0-rc.0, <= 2.4.0-rc.0; >= 2.3.0, <= 2.3.2 · CVE-2026-105163 · GHSA-mf7q-r4rv-jv94 · amended
27 Aug 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.

CISA security events · all vendors

NewsExploited · CISA KEV10 Nov 2026
Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Openwave Messaging Limited Webtop Media Transcoder Incorrect Resource Transfer Between Spheres Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Google Chromium Use-After-Free Vulnerability
NewsExploited · CISA KEV10 Nov 2026
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability

Advisory watch · no fix evidence

NewsUnratednpm11 Nov 2026
Malicious code in chalks-log (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in prettlog (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in @solana-trade/core (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in termchalk (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
NewsUnratednpm11 Nov 2026
Malicious code in kbmathlessons (npm)
Listed as news: the source report lacks affected versions, a fix, or verified evidence.

Browse all news

Know what to patch next.

Actionable

Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforce

Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilities

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment

Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id

Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key

Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0

Vikunja has a project duplication bypasses write-permission check on the target parent project

datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS

Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none

Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

KubeVela Terraform remote loader DoS via unbounded file read

gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)

Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe

Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

aiosmtplib: STARTTLS response injection

WebOb: Open redirect in Location header normalization via leading C0 control / space characters

LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint

Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

News

CISA security events · all vendors

Advisory watch · no fix evidence

Know what to patch next.

At a glance

Activity · last 26 weeks

Actionable

News

CISA security events · all vendors

Advisory watch · no fix evidence