High, CVSS 8.8
OpenClaw: Command-authorized non-owners could reach owner-only /config and /debug surfaces
npm openclaw · Upgrade to 2026.3.12 or later · <= 2026.3.11 · CVE-2026-32914 · GHSA-r7vr-gr74-94p8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 406 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
OpenClaw: Command-authorized non-owners could reach owner-only
- High, CVSS 7.1
OpenClaw:
browser.requestletoperator.writepersist admin-only browser profile changesnpm openclaw · Upgrade to 2026.3.11 or later · <= 2026.3.8 · CVE-2026-32972 · GHSA-vmhq-cqm9-6p7q · amended
- Critical, CVSS 9.9
Apollo Federation vulnerable to prototype pollution via incomplete key sanitization
npm @apollo/federation-internals +2 · Upgrade all 3 to 2.13.2, 2.12.3, 2.11.6 or 2 more by release line · < 2.9.6; >= 2.10.0, < 2.10.5; >= 2.11.0, < 2.11.6; >= 2.12.0, < 2.12.3; >= 2.13.0, < 2.13.2 · CVE-2026-32621 · GHSA-pfjj-6f4p-rvmh · amended
- High, CVSS 7.5
idunno.Bluesky, idunno.AtProto and idunno.AtProto.OAuthCallback Denial of Service Vulnerability
NuGet idunno.bluesky +2 · Upgrade all 3 to 1.7.0 or later · < 1.7.0 · GHSA-8fh9-c4jq-94h4
- High, CVSS 8.2
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
Packagist simplesamlphp/xml-security · Upgrade to 2.3.1 or 1.13.9 by release line · >= 2.0.0, < 2.3.1; < 1.13.9 · CVE-2026-32600 · GHSA-r353-4845-pr5p
- High, CVSS 7.5
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression
npm undici · Upgrade to 7.24.0 or 6.24.0 by release line · < 6.24.0; >= 7.0.0, < 7.24.0 · CVE-2026-1526 · GHSA-vrm6-8vpv-qv8q · amended
- High, CVSS 7.5
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation
npm undici · Upgrade to 7.24.0 or 6.24.0 by release line · < 6.24.0; >= 7.0.0, < 7.24.0 · CVE-2026-2229 · GHSA-v9p9-hfj2-hcw8 · amended
- High, CVSS 7.5
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client
npm undici · Upgrade to 7.24.0 or 6.24.0 by release line · >= 6.0.0, < 6.24.0; >= 7.0.0, < 7.24.0 · CVE-2026-1528 · GHSA-f269-vfmq-vjvj · amended
- High, CVSS 7.5
PyJWT accepts unknown
critheader extensionsPyPI pyjwt · Upgrade to 2.12.0 or later · <= 2.11.0 · CVE-2026-32597 · GHSA-752w-5fwx-jx9f · amended
- High, CVSS 8.7
Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145
crates.io yamux · Upgrade to 0.13.10 or later · < 0.13.10 · CVE-2026-32314 · GHSA-vxx9-2994-q338
- High, CVSS 8.2
xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
Packagist robrichards/xmlseclibs · Upgrade to 3.1.5 or later · < 3.1.5 · CVE-2026-32313 · GHSA-4v26-v6cg-g6f9
- High, CVSS 7.5
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
PyPI scrapy · Upgrade to 2.14.2 or later · >= 1.4.0, <= 2.14.1 · CVE-2026-105782 · GHSA-cwxj-rr6w-m6w7 · amended
- High, CVSS 8.1
Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process
crates.io deno · Upgrade to 2.7.2 or later · >= 2.7.0, < 2.7.2 · CVE-2026-32260 · GHSA-4c96-w8v2-p28j
- High, CVSS 7.6
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
npm oneuptime · Upgrade to 10.0.23 or later · < 10.0.23 · CVE-2026-32308 · GHSA-wvh5-6vjm-23qh · amended
- Critical, CVSS 9.9
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
npm oneuptime · Upgrade to 10.0.23 or later · < 10.0.23 · CVE-2026-32306 · GHSA-p5g2-jm85-8g35 · amended
- High, CVSS 7.5
CairoSVG vulnerable to Exponential DoS via recursive element amplification
PyPI cairosvg · Upgrade to 2.9.0 or later · <= 2.8.2 · CVE-2026-31899 · GHSA-f38f-5xpm-9r7c · amended
- High, CVSS 8.7
Yamux vulnerable to remote Panic via malformed WindowUpdate credit
crates.io yamux · Upgrade to 0.13.9 or later · >= 0.13.0, < 0.13.9 · CVE-2026-31814 · GHSA-4w32-2493-32g7
- Critical, CVSS 9.8
Locutus vulnerable to RCE via unsanitized input in create_function()
npm locutus · Upgrade to 3.0.14 or later · <= 3.0.13 · CVE-2026-32304 · GHSA-vh9h-29pq-r5m8 · amended
- Critical, CVSS 9.2
SM9 Infinity-Point Ciphertext Forgery Vulnerability
Go github.com/emmansun/gmsm · Upgrade to 0.41.1 or later · < 0.41.1 · CVE-2026-32614 · GHSA-5xxp-2vrj-x855
- High, CVSS 7.5
OpenClaw: Sandbox staged writes could escape the verified parent directory before commit
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32988 · GHSA-mj4p-rc52-m843 · amended
- High, CVSS 8.0
OpenClaw: Unrecognized script runners could bypass
system.runapproval integritynpm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32978 · GHSA-qc36-x95h-7j53 · amended
- High, CVSS 7.1
OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32971 · GHSA-rw39-5899-8mxp · amended
- High, CVSS 7.3
OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32979 · GHSA-xf99-j42q-5w5p · amended
- High, CVSS 8.8
OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32915 · GHSA-4w7m-58cg-cmff · amended
- Critical, CVSS 9.9
OpenClaw: Pairing-scoped device tokens could mint
operator.adminand reach node RCEnpm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32922 · GHSA-4jpw-hj22-2xmc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.