High, CVSS 8.2
AWS-LC has Timing Side-Channel in AES-CCM Tag Verification
crates.io aws-lc-sys · Upgrade to 0.38.0 or later · >= 0.14.0, < 0.38.0 · +1 more package · CVE-2026-3337 · GHSA-65p9-r9h6-22vj · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 406 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
AWS-LC has PKCS7_verify Certificate Chain Validation Bypass
crates.io aws-lc-sys · Upgrade to 0.38.0 or later · >= 0.24.0, < 0.38.0 · CVE-2026-3336 · GHSA-vw5v-4f2q-w9xf · amended
- Critical, CVSS 9.8
PickleScan has multiple stdlib modules with direct RCE not in blocklist
PyPI picklescan · Upgrade to 1.0.4 or later · < 1.0.4 · CVE-2026-56315 · GHSA-g38g-8gr9-h9xp · amended
- Critical, CVSS 10.0
PickleScan's pkgutil.resolve_name has a universal blocklist bypass
PyPI picklescan · Upgrade to 1.0.4 or later · < 1.0.4 · CVE-2026-3490 · GHSA-vvpj-8cmc-gx39 · amended
- Critical, CVSS 9.8
PickleScan's profile.run blocklist mismatch allows exec() bypass
PyPI picklescan · Upgrade to 1.0.4 or later · < 1.0.4 · CVE-2026-53873 · GHSA-7wx9-6375-f5wh · amended
- Critical, CVSS 9.8
WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php
Packagist wwbn/avideo · Upgrade to 7.0.0 or later · < 7.0.0 · CVE-2026-29058 · GHSA-9j26-99jh-v26q
- High, CVSS 7.6
Ghost Vulnerable to Remote Code Execution via Malicious Themes
npm ghost · Upgrade to 6.19.1 or later · >= 0.7.2, <= 6.19.0 · CVE-2026-29053 · GHSA-cgc2-rcrh-qr5x · amended
- High, CVSS 8.7
OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · CVE-2026-32030 · GHSA-x9cf-3w63-rpq9 · amended
- High, CVSS 7.3
OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · CVE-2026-32032 · GHSA-f8mp-vj46-cq8v · amended
- High, CVSS 8.5
OpenClaw's andbox browser noVNC observer lacked VNC authentication
npm openclaw · Upgrade to 2026.2.21 or later · < 2026.2.21 · CVE-2026-32064 · GHSA-25gx-x37c-7pph · amended
- High, CVSS 7.1
OpenClaw DM pairing-store identities could satisfy group allowlist authorization
npm openclaw · Upgrade to 2026.2.26 or later · <= 2026.2.25 · CVE-2026-32027 · GHSA-jv6r-27ww-4gw4 · amended
- High, CVSS 8.9
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
npm openclaw · Upgrade to 2026.2.24 or later · <= 2026.2.23 · GHSA-9f72-qcpw-2hxc · amended
- High, CVSS 8.3
OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths
npm openclaw · Upgrade to 2026.2.26 or later · <= 2026.2.25 · CVE-2026-32036 · GHSA-mwxv-35wr-4vvj · amended
- High, CVSS 8.7
OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · CVE-2026-32037 · GHSA-w76h-8m22-hpgh · amended
- High, CVSS 8.3
OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading
npm openclaw · Upgrade to 2026.2.14 or later · >= 2.0.0-beta3, <= 2026.2.13 · CVE-2026-28393 · GHSA-7xhj-55q9-pc3m · amended
- High, CVSS 8.6
OpenClaw has command injection via Windows shell fallback in Lobster tool execution
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · CVE-2026-32000 · GHSA-7fcc-cw49-xm78 · amended
- High, CVSS 7.1
OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection
npm openclaw · Upgrade to 2026.2.25 or later · <= 2026.2.24 · GHSA-qj22-xqjr-v83v · amended
- High, CVSS 8.6
BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
PyPI bentoml · Upgrade to 1.4.36 or later · < 1.4.36 · CVE-2026-27905 · GHSA-m6w7-qv66-g3mf · amended
- High, CVSS 8.2
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
npm underscore · Upgrade to 1.13.8 or later · <= 1.13.7 · CVE-2026-27601 · GHSA-qpx9-hpmf-5gmw · amended
- Critical, CVSS 9.1
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
Packagist froxlor/froxlor · Upgrade to 2.3.4 or later · <= 2.3.3 · CVE-2026-26279 · GHSA-33mp-8p67-xj7c
- High, CVSS 7.5
Django vulnerable to Uncontrolled Resource Consumption
PyPI django · Upgrade to 6.0.3, 5.2.12 or 4.2.29 by release line · >= 6.0, < 6.0.3; >= 5.2, < 5.2.12; >= 4.2, < 4.2.29 · CVE-2026-25673 · GHSA-8p8v-wh79-9r56 · amended
- Critical, CVSS 9.9
Rancher cloud credentials can be used through proxy API by users without access
Go github.com/rancher/rancher · Upgrade to 2.5.9 or 2.4.16 by release line · >= 2.2.0, < 2.4.16; >= 2.5.0, < 2.5.9 · CVE-2021-25320 · GHSA-gqf8-rvrh-g7w6
- High, CVSS 7.1
Rancher's restricted PodSecurityPolicy does not prevent containers from running as a privileged user
Go github.com/rancher/rancher · Upgrade to 2.6.4 or later · >= 2.0.0, < 2.6.4 · GHSA-hwm2-4ph6-w6m5
- Critical, CVSS 9.1
Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)
Go github.com/rancher/rancher · Upgrade to 2.6.7 or 2.5.16 by release line · >= 2.5.0, <= 2.5.15; >= 2.6.0, <= 2.6.6 · CVE-2022-31247 · GHSA-6x34-89p7-95wg
- Critical, CVSS 9.9
Rancher doesn't properly sanitize credentials in cluster template answers
Go github.com/rancher/rancher · Upgrade to 2.6.4 or 2.5.13 by release line · >= 2.5.0, <= 2.5.12; >= 2.6.0, <= 2.6.3 · CVE-2021-36783 · GHSA-8w87-58w6-hfv8
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.