Critical, CVSS 9.4
OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes
npm openclaw · Upgrade to 2026.3.11 or later · >= 2026.3.7, < 2026.3.11 · CVE-2026-32916 · GHSA-xw77-45gv-p728 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 406 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
flatted vulnerable to unbounded recursion DoS in parse() revive phase
npm flatted · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-32141 · GHSA-25h7-pfq9-p65f · amended
- High, CVSS 8.7
Poseidon V1 variable-length input collision via implicit zero-padding
crates.io soroban-poseidon · Upgrade to 25.0.1 or later · < 25.0.1 · CVE-2026-32129 · GHSA-g2p6-hh5v-7hfm
- High, CVSS 8.2
Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
PyPI magic-wormhole · Upgrade to 0.23.0 or later · >= 0.21.0, < 0.23.0 · CVE-2026-32116 · GHSA-4g4c-mfqg-pj8r · amended
- High, CVSS 7.5
Dagu: SSE Authentication Bypass in Basic Auth Mode
npm dagu · Upgrade to 2.2.4 or later · < 2.2.4 · CVE-2026-31882 · GHSA-9wmw-9wph-2vwp · amended
- Critical, CVSS 10.0
SandboxJS affected by a Sandbox Escape
npm @nyariv/sandboxjs · Upgrade to 0.8.34 or later · <= 0.8.33 · CVE-2026-26954 · GHSA-6r9f-759j-hjgv · amended
- High, CVSS 7.5
Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload
Go github.com/ellanetworks/core · Upgrade to 1.5.1 or later · < 1.5.1 · CVE-2026-32319 · GHSA-m9pm-w3gv-c68f
- High, CVSS 8.1
OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32302 · GHSA-5wcw-8jjv-m286 · amended
- High, CVSS 8.4
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
npm @tinacms/cli · Upgrade to 2.1.8 or later · < 2.1.8 · CVE-2026-28793 · GHSA-2f24-mg4x-534q · amended
- Critical, CVSS 9.6
TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
npm @tinacms/cli · Upgrade to 2.1.8 or later · < 2.1.8 · CVE-2026-28792 · GHSA-8pw3-9m7f-q734 · amended
- High, CVSS 8.7
Black: Arbitrary file writes from unsanitized user input in cache file name
PyPI black · Upgrade to 26.3.1 or later · >= 24.3.0, < 26.3.1 · CVE-2026-32274 · GHSA-3936-cmfr-pm3m · amended
- High, CVSS 7.4
Tina: Path Traversal in Media Upload Handle
npm tinacms · Upgrade to 2.1.7 or later · < 2.1.7 · CVE-2026-28791 · GHSA-5hxf-c7j4-279c · amended
- High, CVSS 7.5
multipart vulnerable to ReDoS in
parse_options_header()PyPI multipart · Upgrade to 1.3.1 or 1.2.2 by release line · >= 1.3.0, < 1.3.1; < 1.2.2 · CVE-2026-28356 · GHSA-p2m9-wcp5-6qw3 · amended
- Critical, CVSS 9.3
Parse Server: Account takeover via operator injection in authentication data identifier
npm parse-server · Upgrade to 9.6.0-alpha.12 (pre-release) or 8.6.38 by release line · >= 9.0.0, < 9.6.0-alpha.12; < 8.6.38 · CVE-2026-32248 · GHSA-5fw2-8jcv-xh87 · amended
- Critical, CVSS 9.1
Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
npm parse-server · Upgrade to 9.6.0-alpha.11 (pre-release) or 8.6.37 by release line · >= 9.0.0, < 9.6.0-alpha.11; < 8.6.37 · CVE-2026-32242 · GHSA-2cjm-2gwv-m892 · amended
- High, CVSS 8.1
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
PyPI graphiti-core · Upgrade to 0.28.2 or later · <= 0.28.1 · CVE-2026-32247 · GHSA-gg5m-55jj-8m5g · amended
- High, CVSS 8.5
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
Go github.com/steveiliop56/tinyauth · Upgrade to 1.0.1-20260311144920-9eb2d33064b7 (pre-release) or later · < 1.0.1-20260311144920-9eb2d33064b7 · CVE-2026-32246 · GHSA-3q28-qjrv-qr39
- High, CVSS 8.8
ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
crates.io zeptoclaw · Upgrade to 0.7.6 or later · <= 0.7.5 · CVE-2026-32232 · GHSA-2m67-cxxq-c3h8
- High, CVSS 8.2
ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
crates.io zeptoclaw · Upgrade to 0.7.6 or later · <= 0.7.5 · CVE-2026-32231 · GHSA-46q5-g3j9-wx5c
- High, CVSS 7.6
StudioCMS S3 Storage Manager Authorization Bypass via Missing
awaiton Async Auth Checknpm @studiocms/s3-storage · Upgrade to 0.3.1 or later · <= 0.3.0 · CVE-2026-32101 · GHSA-mm78-fgq8-6pgr · amended
- High, CVSS 7.7
Traefik: HTTP/2 frames can cause a running server to panic
Go github.com/traefik/traefik/v3 · Upgrade to 3.6.10 or later · <= 3.6.9 · +1 more package · GHSA-4hjq-9h5c-252j
- Critical, CVSS 9.8
AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass
Go github.com/AdguardTeam/AdGuardHome · Upgrade to 0.107.73 or later · < 0.107.73 · CVE-2026-32136 · GHSA-5fg6-wrq4-w5gh
- High, CVSS 8.3
SiYuan has a Full-Read SSRF via /api/network/forwardProxy
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.6.0 or later · < 3.6.0 · CVE-2026-32110 · GHSA-56cv-c5p2-j2wg · amended
- High, CVSS 7.0
OpenClaw: Sandbox dangling-symlink alias handling could bypass workspace-only write boundary
npm openclaw · Upgrade to 2026.2.26 or later · <= 2026.2.25 · GHSA-qcc4-p59m-p54m · amended
- High, CVSS 7.2
OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf
npm openclaw · Upgrade to 2026.2.26 or later · <= 2026.2.25 · CVE-2026-32055 · GHSA-mgrq-9f93-wpp5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.