High, CVSS 8.8
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects
npm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · CVE-2026-32913 · GHSA-6mgf-v5j7-45cr · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 406 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage
npm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · GHSA-rchv-x836-w7xp · amended
- High, CVSS 7.3
Glances has SQL Injection via Process Names in TimescaleDB Export
PyPI glances · Upgrade to 4.5.1 or later · < 4.5.1 · CVE-2026-30930 · GHSA-x46r-mf5g-xpr6 · amended
- High, CVSS 8.7
Glances Exposes Unauthenticated Configuration Secrets
PyPI glances · Upgrade to 4.5.1 or later · < 4.5.1 · CVE-2026-30928 · GHSA-gh4x-f7cq-wwx6 · amended
- High, CVSS 8.9
FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)
Go github.com/gtsteffaniak/filebrowser · Upgrade to 0.0.0-20260307130210-09713b32a5f6 (pre-release) or later · < 0.0.0-20260307130210-09713b32a5f6 · CVE-2026-30934 · GHSA-r633-fcgp-m532
- High, CVSS 7.1
FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info
Go github.com/gtsteffaniak/filebrowser/backend · Upgrade to 0.0.0-20260307130210-09713b32a5f6 (pre-release) or later · < 0.0.0-20260307130210-09713b32a5f6 · CVE-2026-30933 · GHSA-525j-95gf-766f
- Critical, CVSS 9.3
Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
npm parse-server · Upgrade to 9.5.0-alpha.11 (pre-release) or 8.6.10 by release line · >= 9.0.0-alpha.1, < 9.5.0-alpha.11; < 8.6.10 · CVE-2026-30863 · GHSA-x6fw-778m-wr9v · amended
- High, CVSS 8.6
OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
npm @oneuptime/common · Upgrade to 10.0.19 or later · < 10.0.19 · CVE-2026-30920 · GHSA-656w-6f6c-m9r6 · amended
- High, CVSS 8.7
Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys
Go github.com/gravitl/netmaker · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-29196 · GHSA-4hgg-c4rr-6h7f
- High, CVSS 8.6
Netmaker has Insufficient Authorization in Host Token Verification
Go github.com/gravitl/netmaker · Upgrade to 1.5.0 or later · < 1.5.0 · CVE-2026-29194 · GHSA-hmqr-wjmj-376c
- High, CVSS 8.5
Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260307173642-b59e35cb59ae (pre-release) or later · < 0.0.0-20260307173642-b59e35cb59ae · CVE-2026-28513 · GHSA-qh6q-598w-w6m2
- High, CVSS 7.1
Pocket ID: OAuth redirect_uri validation bypass via userinfo/host confusion
Go github.com/pocket-id/pocket-id/backend · Upgrade to 0.0.0-20260228130835-3a339e33191c (pre-release) or later · < 0.0.0-20260228130835-3a339e33191c · CVE-2026-28512 · GHSA-9h33-g3ww-mqff
- High, CVSS 8.6
@budibase/server: Command Injection in PostgreSQL Dump Command
npm @budibase/server · Upgrade to 3.23.32 or later · < 3.23.32 · CVE-2026-25041 · GHSA-726g-59wr-cj4c · amended
- High, CVSS 8.8
Apache Airflow Providers Http has Unsafe Pickle Deserializatio leading to RCE via HttpOperator
PyPI apache-airflow-providers-http · Upgrade to 6.0.0 or later · < 6.0.0 · CVE-2025-69219 · GHSA-9r5j-7r2x-rv4g · amended
- Critical, CVSS 9.8
Apache IoTDB has an Insecure Default Configuration Vulnerability
Maven org.apache.iotdb:iotdb-core · Upgrade to 2.0.7 or 1.3.7 by release line · >= 1.0.0, < 1.3.7; >= 2.0.0, < 2.0.7 · CVE-2026-24015 · GHSA-74cf-pgh9-m5q2
- Critical, CVSS 9.8
Apache IoTDB has an Improper Input Validation vulnerability
Maven org.apache.iotdb:iotdb-core · Upgrade to 2.0.7 or 1.3.7 by release line · >= 1.0.0, < 1.3.7; >= 2.0.0, < 2.0.7 · CVE-2026-24713 · GHSA-6w48-2g9j-v9q5
- High, CVSS 7.4
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager
Maven org.apache.zookeeper:zookeeper · Upgrade to 3.9.5 or 3.8.6 by release line · >= 3.8.0, < 3.8.6; >= 3.9.0, < 3.9.5 · CVE-2026-24281 · GHSA-7xrh-hqfc-g7qr
- High, CVSS 8.7
Apache ZooKeeper has improper handling of configuration values
Maven org.apache.zookeeper:zookeeper · Upgrade to 3.9.5 or 3.8.6 by release line · >= 3.9.0, < 3.9.5; >= 3.8.0, < 3.8.6 · CVE-2026-24308 · GHSA-crhr-qqj8-rpxc
- High, CVSS 7.2
Meta Box Plugin for WordPress: Authenticated (Contributor+) Arbitrary File Deletion via ajax_delete_file
Packagist wpmetabox/meta-box · Upgrade to 5.11.2 or later · < 5.11.2 · CVE-2025-14675 · GHSA-m4q3-832v-44j6
- Critical, CVSS 9.9
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object
npm @oneuptime/common · Upgrade to 10.0.20 or later · < 10.0.20 · CVE-2026-30921 · GHSA-4j36-39gm-8vq8 · amended
- High, CVSS 8.1
FUXA has a hardcoded fallback JWT signing secret
npm @frangoteam/fuxa · Upgrade to 1.3.0 or later · <= 1.2.11 · CVE-2025-69971 · GHSA-c8m8-3jcr-6rj5 · amended
- Critical, CVSS 9.9
OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE
npm @oneuptime/common · Upgrade to 10.0.18 or later · < 10.0.18 · CVE-2026-30887 · GHSA-h343-gg57-2q67 · amended
- Critical, CVSS 9.3
SiYuan Vulnerable to Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 3.5.10 or later · < 3.5.10 · CVE-2026-30869 · GHSA-2h2p-mvfx-868w · amended
- High, CVSS 8.1
mcp-memory-service's Wildcard CORS with Credentials Enables Cross-Origin Memory Theft
PyPI mcp-memory-service · Upgrade to 10.25.1 or later · < 10.25.1 · CVE-2026-33010 · GHSA-g9rg-8vq5-mpwm · amended
- Critical, CVSS 10.0
WeKnora has Remote Code Execution (RCE) via Command Injection in MCP Stdio Configuration Validation
Go github.com/Tencent/WeKnora · Upgrade to 0.2.10 or later · >= 0.2.5, < 0.2.10 · CVE-2026-30861 · GHSA-r55h-3rwj-hcmg
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.