High, CVSS 7.7
sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKey
npm sjcl · Upgrade to 1.0.9 or later · <= 1.0.8 · CVE-2026-4258 · GHSA-2w8x-224x-785m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 406 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.0
Admidio has a Second-Order SQL Injection via List Configuration (lsc_special_field, lsc_sort, lsc_filter)
Packagist admidio/admidio · Upgrade to 5.0.7 or later · <= 5.0.6 · CVE-2026-32813 · GHSA-3x67-4c2c-w45m
- Critical, CVSS 9.1
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
Packagist admidio/admidio · Upgrade to 5.0.7 or later · >= 5.0.0, <= 5.0.6 · CVE-2026-32817 · GHSA-rmpj-3x5m-9m5f
- High, CVSS 8.8
File Upload(RCE) Vulnerability in admidio
Packagist admidio/admidio · Upgrade to 5.0.7 or later · <= 5.0.6 · CVE-2026-32756 · GHSA-95cq-p4w2-32w5
- High, CVSS 8.2
lz4_flex's decompression can leak information from uninitialized memory or reused output buffer
crates.io lz4_flex · Upgrade to 0.12.1 or 0.11.6 by release line · < 0.11.6; >= 0.12.0, < 0.12.1 · CVE-2026-32829 · GHSA-vvp9-7p8x-rfvv
- High, CVSS 7.1
Fullchain's Invalid NetworkPolicy enables a malicious actor to pivot into another namespace
Go github.com/ctfer-io/fullchain · Upgrade to 0.1.1 or later · < 0.1.1 · CVE-2026-32769 · GHSA-hxm7-9q36-c77f
- High, CVSS 8.3
Romeo is vulnerable to Archive Slip due to missing checks in sanitization
Go github.com/ctfer-io/romeo/webserver · Upgrade to 0.2.2 or later · < 0.2.2 · CVE-2026-32805 · GHSA-p799-g7vv-f279
- High, CVSS 8.3
Monitoring is vulnerable to Archive Slip due to missing checks in sanitization
Go github.com/ctfer-io/monitoring · Upgrade to 0.2.2 or later · < 0.2.2 · CVE-2026-32771 · GHSA-f7cq-gvh6-qr25
- High, CVSS 7.9
Romeo's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
Go github.com/ctfer-io/romeo/environment/deploy · Upgrade to 0.2.1 or later · < 0.2.1 · CVE-2026-32737 · GHSA-fgm3-q9r5-43v9
- High, CVSS 7.9
Chall-Manager's invalid NetworkPolicy enables a malicious actor to pivot into another namespace
Go github.com/ctfer-io/chall-manager/deploy +1 · Upgrade all 2 to 0.6.5 or later · < 0.6.5 · CVE-2026-32768 · GHSA-mw24-f3xh-j3qv
- Critical, CVSS 10.0
File Browser Signup Grants Admin When Default Permissions Include Admin
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.62.0 or later · <= 2.61.2 · CVE-2026-32760 · GHSA-5gg9-5g7w-hm73
- High, CVSS 7.2
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
npm openclaw · Upgrade to 2026.3.13 or later · <= 2026.3.12 · CVE-2026-32917 · GHSA-g2f6-pwvx-r275 · amended
- High, CVSS 8.7
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
npm openclaw · Upgrade to 2026.3.13 or later · <= 2026.3.12 · CVE-2026-32980 · GHSA-jq3f-vjww-8rq7 · amended
- High, CVSS 8.6
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
npm openclaw · Upgrade to 2026.3.13 or later · <= 2026.3.12 · CVE-2026-32987 · GHSA-63f5-hhc7-cx6p · amended
- High, CVSS 8.3
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
npm parse-server · Upgrade to 9.6.0-alpha.15 (pre-release) or 8.6.41 by release line · >= 9.0.0, < 9.6.0-alpha.15; < 8.6.41 · CVE-2026-32728 · GHSA-42ph-pf9q-cr72 · amended
- High, CVSS 8.7
Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability
Packagist craftcms/azure-blob · Upgrade to 2.1.1 or later · >= 2.0.0-beta.1, <= 2.1.0 · CVE-2026-32268 · GHSA-q6fm-p73f-x862
- High, CVSS 7.7
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
Packagist craftcms/cms · Upgrade to 5.9.12 or 4.17.6 by release line · >= 4.0.0-RC1, <= 4.17.5; >= 5.0.0-RC1, <= 5.9.11 · CVE-2026-32267 · GHSA-cc7p-2j3x-x7xf
- High, CVSS 7.5
GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute
Go github.com/osrg/gobgp/v4 · Upgrade to 4.4.0 or later · <= 4.3.0 · CVE-2026-30405 · GHSA-4p9m-8gc4-rw2h
- High, CVSS 8.6
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
Packagist craftcms/cms · Upgrade to 5.9.11 or 4.17.5 by release line · >= 4.0.0-RC1, <= 4.17.4; >= 5.0.0-RC1, <= 5.9.10 · CVE-2026-32264 · GHSA-4484-8v2f-5748
- High, CVSS 8.6
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Packagist craftcms/cms · Upgrade to 5.9.11 or later · >= 5.6.0, <= 5.9.10 · CVE-2026-32263 · GHSA-qx2q-q59v-wf3j
- High, CVSS 8.5
RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin
Packagist craftcms/webhooks · Upgrade to 3.2.0 or later · >= 3.0.0, < 3.2.0 · CVE-2026-32261 · GHSA-8wg7-wm29-2rvg
- High, CVSS 8.1
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
PyPI glances · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-32634 · GHSA-vx5f-957p-qpvm · amended
- Critical, CVSS 9.1
Glances's Browser API Exposes Reusable Downstream Credentials via
/api/4/serverslistPyPI glances · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-32633 · GHSA-r297-p3v4-wp8m · amended
- High, CVSS 7.0
Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
PyPI glances · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-32611 · GHSA-49g7-2ww7-3vf5 · amended
- High, CVSS 8.1
Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
PyPI glances · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-32610 · GHSA-9jfm-9rc6-2hfq · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.