OpenClaw's device removal and token revocation do not terminate active WebSocket sessions
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-34503 · GHSA-2pr2-hcv6-7gwv · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-34503 · GHSA-2pr2-hcv6-7gwv · amended
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-41342 · GHSA-3cw3-5vxw-g2h3 · amended
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-33579 · GHSA-hc5h-pmr3-3497 · amended
npm openclaw · Upgrade to 2026.3.28 or later · < 2026.3.28 · CVE-2026-41395 · GHSA-8689-gm9g-jgr6 · amended
npm parse-server · Upgrade to 9.7.0-alpha.12 (pre-release) or 8.6.68 by release line · >= 9.0.0, < 9.7.0-alpha.12; < 8.6.68 · CVE-2026-34573 · GHSA-mfj6-6p54-m98c · amended
npm parse-server · Upgrade to 9.7.0-alpha.11 (pre-release) or 8.6.67 by release line · >= 9.0.0, < 9.7.0-alpha.11; < 8.6.67 · CVE-2026-34532 · GHSA-vpj2-qq7w-5qq6 · amended
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.62.2 or later · <= 2.62.1 · CVE-2026-34528 · GHSA-x8jc-jvqm-pm3f
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.62.2 or later · <= 2.62.1 · CVE-2026-34529 · GHSA-5vpr-4fgw-f69h
PyPI openssl-encrypt · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2026-74878 · GHSA-h45m-mgcp-q388 · amended
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.2 or later · <= 3.6.1 · CVE-2026-34453 · GHSA-c77m-r996-jr3q
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.2 or later · <= 3.6.1 · CVE-2026-34449 · GHSA-68p4-j234-43mv
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.2 or later · <= 3.6.1 · CVE-2026-34448 · GHSA-rx4h-526q-4458
Packagist admidio/admidio · Upgrade to 5.0.8 or later · >= 5.0.0, < 5.0.8 · CVE-2026-34381 · GHSA-7fh7-8xqm-3g88
PyPI fastmcp · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-32871 · GHSA-vv7q-7jx5-f767 · amended
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-32734 · GHSA-677c-xv24-crgx
PyPI scitokens · Upgrade to 1.9.7 or later · < 1.9.7 · CVE-2026-32727 · GHSA-3x2w-63fp-3qvw · amended
PyPI scitokens · Upgrade to 1.9.6 or later · < 1.9.6 · CVE-2026-32716 · GHSA-w8fp-g9rh-34jh · amended
PyPI scitokens · Upgrade to 1.9.6 or later · < 1.9.6 · CVE-2026-32714 · GHSA-rh5m-2482-966c · amended
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-30940 · GHSA-c5c6-37vq-pjcq
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-30880 · GHSA-6hpg-8rx3-cwgv
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-30877 · GHSA-m9g7-rgfc-jcm7
PyPI onnx · Upgrade to 1.21.0 or later · < 1.21.0 · CVE-2026-27489 · GHSA-3r9x-f23j-gc73 · amended
PyPI fastmcp · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2026-27124 · GHSA-rww4-4w9c-7733 · amended
Go github.com/cloudreve/Cloudreve/v4 · Upgrade to 4.0.0-20260205113604-ec9fdd33bc54 (pre-release) or later · < 4.0.0-20260205113604-ec9fdd33bc54 · CVE-2026-25726 · GHSA-f8xp-wvcx-p6f4
Packagist baserproject/basercms · Upgrade to 5.2.3 or later · <= 5.2.2 · CVE-2026-21861 · GHSA-qxmc-6f24-g86g
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.