High, CVSS 8.0
Rancher's Azure AD permission changes are not reflected on active sessions
Go github.com/rancher/rancher · Upgrade to 2.7.4 or 2.6.13 by release line · >= 2.6.7, < 2.6.13; >= 2.7.0, < 2.7.4 · CVE-2023-22648 · GHSA-vf6j-6739-78m8
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 406 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
Apache Ranger has a Code Injection vulnerability
Maven org.apache.ranger:ranger-plugins-common · Upgrade to 2.8.0 or later · < 2.8.0 · CVE-2025-59059 · GHSA-c87w-642h-m97h
- High, CVSS 7.5
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · CVE-2026-32003 · GHSA-2fgq-7j6h-9rm4 · amended
- High, CVSS 8.6
OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy
npm openclaw · Upgrade to 2026.2.26 or later · <= 2026.2.25 · CVE-2026-32014 · GHSA-r65x-2hqr-j5hf · amended
- High, CVSS 8.7
OpenClaw: Node system.run approval bypass via parent-symlink cwd rebind
npm openclaw · Upgrade to 2026.2.26 or later · <= 2026.2.25 · CVE-2026-27545 · GHSA-f7ww-2725-qvw2 · amended
- High, CVSS 8.7
OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset
npm openclaw · Upgrade to 2026.2.24 or later · <= 2026.2.23 · CVE-2026-27522 · GHSA-fqcm-97m6-w7rm · amended
- High, CVSS 8.8
OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval
npm openclaw · Upgrade to 2026.2.14 or later · < 2026.2.14 · GHSA-943q-mwmv-hhvh · amended
- Critical, CVSS 9.4
OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway
npm openclaw · Upgrade to 2026.2.14 or later · < 2026.2.14 · CVE-2026-28466 · GHSA-gv46-4xfq-jv58 · amended
- High, CVSS 8.2
OpenClaw has non-constant-time token comparison in hooks authentication
npm openclaw · Upgrade to 2026.2.12 or later · < 2026.2.12 · CVE-2026-28464 · GHSA-jmm5-fvh5-gf4p · amended
- High, CVSS 8.3
OpenClaw has Zip Slip path traversal in tar archive extraction
npm openclaw · Upgrade to 2026.2.14 or later · < 2026.2.14 · CVE-2026-28453 · GHSA-p25h-9q54-ffvw · amended
- Critical, CVSS 9.3
OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write
npm openclaw · Upgrade to 2026.2.25 or later · < 2026.2.25 · CVE-2026-32013 · GHSA-fgvx-58p6-gjwc · amended
- High, CVSS 8.7
OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure
npm openclaw +1 · Upgrade all 2 to 2026.2.22 or later · < 2026.2.22 · CVE-2026-32062 · GHSA-mfg5-7q5g-f37j · amended
- High, CVSS 8.7
OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · CVE-2026-32049 · GHSA-rxxp-482v-7mrh · amended
- High, CVSS 7.1
OpenClaw Canvas Path Traversal Information Disclosure Vulnerability
npm openclaw · Upgrade to 2026.2.21 or later · < 2026.2.21 · CVE-2026-3689 · GHSA-jq4x-98m3-ggq6 · amended
- High, CVSS 8.5
OpenClaw has Windows system.run approval mismatch on cmd.exe /c trailing arguments
npm openclaw · Upgrade to 2026.2.21 or later · < 2026.2.21 · CVE-2026-22168 · GHSA-5v6x-rfc3-7qfr · amended
- High, CVSS 7.5
@keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script
npm @keep-network/tbtc-v2 · Upgrade to 1.8.2 or later · <= 1.8.1 · GHSA-8986-v76q-8vr2 · amended
- High, CVSS 8.7
OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind
npm openclaw · Upgrade to 2026.3.1 or later · < 2026.3.1 · CVE-2026-31997 · GHSA-q399-23r3-hfx4 · amended
- High, CVSS 8.7
OpenClaw has web_search citation redirect SSRF via private-network-allowing policy
npm openclaw · Upgrade to 2026.3.1 or later · < 2026.3.1 · CVE-2026-31989 · GHSA-g99v-8hwm-g76g · amended
- High, CVSS 8.7
OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools
npm openclaw · Upgrade to 2026.3.1 or later · < 2026.3.1 · CVE-2026-32051 · GHSA-jr6x-2q95-fh2g · amended
- High, CVSS 8.7
OpenClaw: Sandbox media TOCTOU could read files outside sandbox root
npm openclaw · Upgrade to 2026.3.1 or later · < 2026.3.1 · GHSA-7xmq-g46g-f8pv · amended
- High, CVSS 8.7
OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries
npm openclaw · Upgrade to 2026.3.1 or later · < 2026.3.1 · GHSA-x82f-27x3-q89c · amended
- Critical, CVSS 9.3
CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths
npm openclaw · Upgrade to 2026.3.1 or later · >= 2026.2.26, < 2026.3.1 · CVE-2026-31999 · GHSA-6f6j-wx9w-ff4j · amended
- High, CVSS 7.5
OpenClaw: Browser control startup could continue unauthenticated after auth bootstrap failure
npm openclaw · Upgrade to 2026.3.1 or later · < 2026.3.1 · CVE-2026-32041 · GHSA-vpj2-69hf-rppw · amended
- High, CVSS 8.7
OpenChatBI has a Path Traversal Vulnerability in save_report Tool
PyPI openchatbi · Upgrade to 0.2.2 or later · <= 0.2.1 · CVE-2026-28795 · GHSA-vmwq-8g8c-jm79 · amended
- Critical, CVSS 9.3
@orpc/clienthas Prototype Pollution viaStandardRPCJsonSerializerDeserializationnpm @orpc/client · Upgrade to 1.13.6 or later · <= 1.13.5 · CVE-2026-28794 · GHSA-m272-9rp6-32mc · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.