High, CVSS 8.7
OpenClaw replaced a deprecated sandbox hash algorithm
npm openclaw · Upgrade to 2026.2.15 or later · <= 2026.2.14 · CVE-2026-28479 · GHSA-fh3f-q9qw-93j9 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 408 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.9
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
PyPI semantic-kernel · Upgrade to 1.39.4 or later · < 1.39.4 · CVE-2026-26030 · GHSA-xjw9-4gw8-4rqx · amended
- High, CVSS 8.1
jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)
npm jspdf · Upgrade to 4.2.0 or later · < 4.2.0 · CVE-2026-25940 · GHSA-p5xg-68wr-hm3m · amended
- High, CVSS 8.1
jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method
npm jspdf · Upgrade to 4.2.0 or later · < 4.2.0 · CVE-2026-25755 · GHSA-9vjf-qc39-jprp · amended
- Critical, CVSS 9.1
carbon-apimgt does not properly restrict uploaded files
Maven org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 · Upgrade to 9.32.167 or later · < 9.32.167 · CVE-2025-13590 · GHSA-p6jf-79j3-33f3
- High, CVSS 8.7
jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions
npm jspdf · Upgrade to 4.2.0 or later · < 4.2.0 · CVE-2026-25535 · GHSA-67pg-wm7f-q7fj · amended
- Critical, CVSS 9.4
Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpoints
Go github.com/akuity/kargo · Upgrade to 1.9.3, 1.8.11 or 1.7.8 by release line · >= 1.9.0-rc.1, < 1.9.3; >= 1.8.0-rc.1, < 1.8.11; >= 1.7.0, < 1.7.8 · CVE-2026-27112 · GHSA-7g9x-cp9g-92mr
- High, CVSS 7.6
Fabric.js Affected by Stored XSS via SVG Export
npm fabric · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2026-27013 · GHSA-hfvx-25r5-qc3w · amended
- High, CVSS 7.7
OpenClaw: Docker container escape via unvalidated bind mount config injection
npm openclaw · Upgrade to 2026.2.15 or later · < 2026.2.15 · CVE-2026-27002 · GHSA-w235-x559-36mg · amended
- High, CVSS 8.6
OpenClaw: Unsanitized CWD path injection into LLM prompts
npm openclaw · Upgrade to 2026.2.15 or later · < 2026.2.15 · CVE-2026-27001 · GHSA-2qj5-gwg2-xwc4 · amended
- High, CVSS 7.1
Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading
PyPI keras · Upgrade to 3.13.2 or 3.12.1 by release line · >= 3.13.0, < 3.13.2; >= 3.0.0, < 3.12.1 · CVE-2026-1669 · GHSA-3m4q-jmj6-r34q · amended
- High, CVSS 8.7
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
npm minimatch · Upgrade to 10.2.1, 9.0.6, 8.0.5 or 5 more by release line · >= 10.0.0, < 10.2.1; >= 9.0.0, < 9.0.6; >= 8.0.0, < 8.0.5; >= 7.0.0, < 7.4.7; >= 6.0.0, < 6.2.1; >= 5.0.0, < 5.1.7; >= 4.0.0, < 4.2.4; < 3.1.3 · CVE-2026-26996 · GHSA-3ppc-4f35-3m26 · amended
- High, CVSS 8.8
Command Injection via Unsanitized
locateOutput inversions()— systeminformationnpm systeminformation · Upgrade to 5.31.0 or later · < 5.31.0 · CVE-2026-26318 · GHSA-5vv4-hvf7-2h46 · amended
- High, CVSS 8.7
Go Ethereum affected by DoS via malicious p2p message
Go github.com/ethereum/go-ethereum · Upgrade to 1.16.9 or later · <= 1.16.8 · CVE-2026-26314 · GHSA-2gjw-fg97-vg3r
- High, CVSS 8.8
LibreNMS has a Time-Based Blind SQL Injection in address-search.inc.php
Packagist librenms/librenms · Upgrade to 26.2.0 or later · < 26.2.0 · CVE-2026-26990 · GHSA-79q9-wc6p-cf92
- High, CVSS 8.4
Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path
npm systeminformation · Upgrade to 5.30.8 or later · < 5.30.8 · CVE-2026-26280 · GHSA-9c88-49p5-5ggf · amended
- Critical, CVSS 9.4
Ghost has a SQL injection in Content API
npm ghost · Upgrade to 6.19.1 or later · >= 3.24.0, < 6.19.1 · CVE-2026-26980 · GHSA-w52v-v783-gw97 · amended
- High, CVSS 7.6
Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde
npm @tygo-van-den-hurk/slyde · Upgrade to 0.0.5 or later · < 0.0.5 · CVE-2026-26974 · GHSA-w7h5-55jg-cq2f · amended
- Critical, CVSS 10.0
NLTK has a Zip Slip Vulnerability
PyPI nltk · Upgrade to 3.9.3 or later · <= 3.9.2 · CVE-2025-14009 · GHSA-7p94-766c-hgjp · amended
- High, CVSS 7.1
Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER
PyPI picklescan · Upgrade to 1.0.3 or later · < 1.0.3 · CVE-2026-53875 · GHSA-97f8-7cmv-76j2 · amended
- High, CVSS 7.1
OpenClaw has an authentication bypass in sandbox browser bridge server
npm openclaw · Upgrade to 2026.2.14 or later · >= 2026.1.29-beta.1, < 2026.2.14 · CVE-2026-28468 · GHSA-h9g4-589h-68xv · amended
- High, CVSS 8.6
OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension
npm openclaw · Upgrade to 2026.2.14 or later · < 2026.2.14 · CVE-2026-28451 · GHSA-x22m-j5qq-j49m · amended
- High, CVSS 7.5
OpenClaw has a LFI in BlueBubbles media path handling
npm openclaw · Upgrade to 2026.2.14 or later · < 2026.2.14 · CVE-2026-29611 · GHSA-rwj8-p9vq-25gv · amended
- High, CVSS 7.6
OpenClaw: Prevent shell injection in macOS keychain credential write
npm openclaw · Upgrade to 2026.2.14 or later · < 2026.2.14 · CVE-2026-27487 · GHSA-4564-pvr2-qq4h · amended
- High, CVSS 8.7
OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes
npm openclaw · Upgrade to 2026.2.13 or later · < 2026.2.13 · CVE-2026-28462 · GHSA-gq9c-wg68-gwj2 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.