Critical, CVSS 9.2
Zebra has rk Identity Point Panic in Transaction Verification
crates.io zebra-chain · Upgrade to 6.0.2 or later · < 6.0.2 · +1 more package · CVE-2026-41584 · GHSA-452v-w3gx-72wg
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 405 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
pretalx vulnerable to stored cross-site scripting in organizer search typeahead
PyPI pretalx · Upgrade to 2026.1.0 or later · < 2026.1.0 · CVE-2026-41241 · GHSA-cjcx-jfp2-f7m2 · amended
- High, CVSS 8.3
Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations
PyPI dagster · Upgrade to 1.13.1 or later · <= 1.13.0 · +5 more packages · CVE-2026-41490 · GHSA-mjw2-v2hm-wj34 · amended
- High, CVSS 8.8
YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
Packagist yeswiki/yeswiki · Upgrade to 4.6.1 or later · <= 4.6.0 · CVE-2026-41143 · GHSA-f58v-p6j9-24c2
- Critical, CVSS 9.3
Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass
Go github.com/nhost/nhost · Upgrade to 0.0.0-20260417112436-ec8dab3f2cf4 (pre-release) or later · < 0.0.0-20260417112436-ec8dab3f2cf4 · CVE-2026-41574 · GHSA-6g38-8j4p-j3pr
- High, CVSS 7.8
PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes
Packagist phpunit/phpunit · Upgrade to 13.1.6 or 12.5.22 by release line · >= 12.5.21, <= 12.5.21; >= 13.1.5, <= 13.1.5 · CVE-2026-41570 · GHSA-qrr6-mg7r-m243
- Critical, CVSS 9.2
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability
npm flowise +1 · Upgrade all 2 to 3.1.0 or later · <= 3.0.13 · CVE-2026-41265 · GHSA-v38x-c887-992f · amended
- High, CVSS 7.2
Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks
crates.io zebra-consensus · Upgrade to 5.0.2 or later · < 5.0.2 · +1 more package · CVE-2026-40880 · GHSA-xvj8-ph7x-65gf
- High, CVSS 8.9
elFinder: Command injection in resize background color parameter when using ImageMagick CLI
Packagist studio-42/elfinder · Upgrade to 2.1.67 or later · < 2.1.67 · CVE-2026-41247 · GHSA-8q4h-8crm-5cvc
- Critical, CVSS 9.2
OpenClaw: Feishu webhook and card-action validation now fail closed
npm openclaw · Upgrade to 2026.4.15 or later · < 2026.4.15 · CVE-2026-44109 · GHSA-xh72-v6v9-mwhc · amended
- Critical, CVSS 9.2
OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
npm openclaw · Upgrade to 2026.4.15 or later · < 2026.4.15 · CVE-2026-43585 · GHSA-xmxx-7p24-h892 · amended
- Critical, CVSS 9.8
Remote Code Execution (RCE) via String Literal Injection into math-codegen
npm math-codegen · Upgrade to 0.4.3 or later · < 0.4.3 · CVE-2026-41507 · GHSA-p6x5-p4xf-cc4r · amended
- High, CVSS 8.1
PraisonAI: SQL Injection via unvalidated
table_prefixin 9 conversation store backends (incomplete fix for CVE-2026-40315)PyPI praisonai · Upgrade to 4.5.149 or later · <= 4.5.148 · +1 more package · CVE-2026-41496 · GHSA-rg3h-x3jw-7jm5 · amended
- Critical, CVSS 9.8
PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection
PyPI praisonai · Upgrade to 4.5.149 or later · <= 4.5.148 · CVE-2026-41497 · GHSA-9qhq-v63v-fv3j · amended
- High, CVSS 8.4
OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR
Go go.opentelemetry.io/obi · Upgrade to 0.8.0 or later · >= 0.4.0, < 0.8.0 · CVE-2026-41433 · GHSA-8gmg-3w2q-65f4
- High, CVSS 8.1
Dapr: Service Invocation path traversal ACL bypass
Go github.com/dapr/dapr · Upgrade to 1.17.5, 1.16.14 or 1.15.14 by release line · >= 1.17.0-rc.1, < 1.17.5; >= 1.16.0-rc.1, < 1.16.14; >= 1.3.0, < 1.15.14 · CVE-2026-41491 · GHSA-85gx-3qv6-4463
- High, CVSS 7.1
OpenClaw: QQBot media tags could read arbitrary local files through reply text
npm openclaw · Upgrade to 2026.4.10 or later · < 2026.4.10 · CVE-2026-43533 · GHSA-66r7-m7xm-v49h · amended
- High, CVSS 8.6
OpenClaw: busybox and toybox applet execution weakened exec approval binding
npm openclaw · Upgrade to 2026.4.12 or later · >= 2026.2.23, < 2026.4.12 · CVE-2026-43530 · GHSA-2cq5-mf3v-mx44 · amended
- High, CVSS 7.1
OpenClaw: Matrix profile config persistence was reachable from operator.write message tools
npm openclaw · Upgrade to 2026.4.10 or later · < 2026.4.10 · CVE-2026-42433 · GHSA-7jp6-r74r-995q · amended
- High, CVSS 8.3
OpenClaw: Sandboxed agents could escape exec routing via host=node override
npm openclaw · Upgrade to 2026.4.10 or later · >= 2026.4.5, < 2026.4.10 · CVE-2026-42434 · GHSA-736r-jwj6-4w23 · amended
- High, CVSS 8.6
OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
npm openclaw · Upgrade to 2026.4.9 or later · < 2026.4.9 · CVE-2026-43569 · GHSA-939r-rj45-g2rj · amended
- High, CVSS 7.5
OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0
npm openclaw · Upgrade to 2026.4.10 or later · < 2026.4.10 · CVE-2026-43581 · GHSA-525j-hqq2-66r4 · amended
- High, CVSS 7.1
OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows
npm openclaw · Upgrade to 2026.4.10 or later · < 2026.4.10 · CVE-2026-43571 · GHSA-82qx-6vj7-p8m2 · amended
- High, CVSS 8.7
OpenClaw: Exec environment denylist missed high-risk interpreter startup variables
npm openclaw · Upgrade to 2026.4.10 or later · < 2026.4.10 · CVE-2026-43584 · GHSA-vfp4-8x56-j7c5 · amended
- High, CVSS 8.2
OpenClaw: Voice-call realtime WebSocket accepted oversized frames
npm openclaw · Upgrade to 2026.4.10 or later · >= 2026.4.9, < 2026.4.10 · CVE-2026-42437 · GHSA-vw3h-q6xq-jjm5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.