Critical, CVSS 9.2
OpenClaw has an inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching)
npm openclaw · Upgrade to 2026.2.2 or later · < 2026.2.2 · CVE-2026-28446 · GHSA-4rj2-gpmh-qq5x · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 408 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 565 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
Nextcloud Talk allowlist bypass via actor.name display name spoofing
npm @openclaw/nextcloud-talk · Upgrade to 2026.2.6 or later · <= 2026.2.2 · CVE-2026-28474 · GHSA-r5h9-vjqc-hq3r · amended
- Critical, CVSS 9.1
OpenClaw has a potential access-group authorization bypass if channel type lookup fails
npm openclaw · Upgrade to 2026.2.1 or later · < 2026.2.1 · CVE-2026-28454 · GHSA-fhvm-j76f-qmjv · amended
- High, CVSS 7.5
OpenClaw BlueBubbles webhook auth bypass via loopback proxy trust
npm openclaw +1 · Upgrade all 2 to 2026.2.13 or later · < 2026.2.13 · CVE-2026-26316 · GHSA-pchc-86f6-8758 · amended
- High, CVSS 7.5
Apache Tomcat has an Improper Input Validation vulnerability
Maven org.apache.tomcat:tomcat-coyote-ffm +2 · Upgrade all 3 to 11.0.18, 10.1.52 or 9.0.115 by release line · >= 11.0.0-M1, < 11.0.18; >= 10.1.0-M7, < 10.1.52; >= 9.0.83, < 9.0.115 · CVE-2026-24734 · GHSA-mgp5-rv84-w37q · amended
- High, CVSS 7.5
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
npm fast-xml-parser · Upgrade to 5.3.6 or 4.5.4 by release line · >= 4.1.3, < 4.5.4; >= 5.0.0, < 5.3.6 · CVE-2026-26278 · GHSA-jmr7-xgp7-cmfj · amended
- High, CVSS 7.5
Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass
crates.io httpsig-hyper · Upgrade to 0.0.23 or later · < 0.0.23 · CVE-2026-26275 · GHSA-7v42-g35v-xrch
- High, CVSS 7.5
The rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide
crates.io soroban-sdk-macros · Upgrade to 25.1.1, 23.5.2 or 22.0.10 by release line · >= 25.0.0, <= 25.1.0; >= 23.0.0, <= 23.5.1; <= 22.0.9 · CVE-2026-26267 · GHSA-4chv-4c6w-w254
- High, CVSS 7.0
emp3r0r Affected by Concurrent Map Access DoS (panic/crash)
Go github.com/jm33-m0/emp3r0r/core · Upgrade to 0.0.0-20260212232424-ea4d074f081d (pre-release) or later · < 0.0.0-20260212232424-ea4d074f081d · CVE-2026-26201 · GHSA-f5p9-j34q-pwcc
- Critical, CVSS 9.2
Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
Packagist pterodactyl/panel · Upgrade to 1.12.1 or later · < 1.12.1 · CVE-2026-26016 · GHSA-g7vw-f8p5-c728
- High, CVSS 7.5
OpenClaw has a Telegram webhook request forgery (missing
channels.telegram.webhookSecret) → auth bypassnpm openclaw · Upgrade to 2026.2.1 or later · < 2026.2.1 · CVE-2026-25474 · GHSA-mp5h-m6qj-6292 · amended
- High, CVSS 7.1
Gogs has a Protected Branch Deletion Bypass in Web Interface
Go gogs.io/gogs · Upgrade to 0.14.1 or later · < 0.14.1 · CVE-2026-25232 · GHSA-2c6v-8r3v-gh6p
- High, CVSS 7.5
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change
Packagist pterodactyl/panel +1 · Upgrade all 2 to 1.12.1 or later · < 1.12.1 · GHSA-hr7j-63v7-vj7g
- High, CVSS 8.2
OpenClaw has a webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)
npm openclaw · Upgrade to 2026.2.12 or later · < 2026.2.12 · CVE-2026-29613 · GHSA-xc7w-v5x6-cc87 · amended
- High, CVSS 7.6
OpenClaw affected by SSRF in Image Tool Remote Fetch
npm openclaw · Upgrade to 2026.2.2 or later · < 2026.2.2 · GHSA-56f2-hvwg-5743 · amended
- High, CVSS 7.4
OpenClaw has an exec allowlist bypass via command substitution/backticks inside double quotes
npm openclaw · Upgrade to 2026.2.2 or later · < 2026.2.2 · CVE-2026-28470 · GHSA-3hcm-ggvf-rch5 · amended
- High, CVSS 7.4
OpenClaw's Windows cmd.exe parsing may bypass exec allowlist/approval gating
npm openclaw · Upgrade to 2026.2.2 or later · < 2026.2.2 · CVE-2026-28391 · GHSA-qj77-c3c8-9c3q · amended
- High, CVSS 7.1
OpenClaw has an arbitrary transcript path file write via gateway sessionFile
npm openclaw · Upgrade to 2026.2.12 or later · < 2026.2.12 · CVE-2026-28459 · GHSA-64qx-vpxx-mvqf · amended
- High, CVSS 7.1
OpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing
npm openclaw · Upgrade to 2026.2.12 or later · >= 2.0.0-beta3, < 2026.2.12 · GHSA-hv93-r4j3-q65f · amended
- Critical, CVSS 9.3
OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated
npm openclaw · Upgrade to 2026.2.2 or later · < 2026.2.2 · CVE-2026-28472 · GHSA-rv39-79c4-7459 · amended
- High, CVSS 7.5
Rack has a Directory Traversal via Rack:Directory
RubyGems rack · Upgrade to 3.2.5, 3.1.20 or 2.2.22 by release line · < 2.2.22; >= 3.0.0.beta1, < 3.1.20; >= 3.2.0, < 3.2.5 · CVE-2026-22860 · GHSA-mxw3-3hh2-x2mh
- High, CVSS 7.0
Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering
PyPI pyarrow · Upgrade to 23.0.1 or later · >= 15.0.0, < 23.0.1 · CVE-2026-25087 · GHSA-rgxp-2hwp-jwgg · amended
- High, CVSS 8.7
Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates
Maven org.apache.nifi:nifi-web-api · Upgrade to 2.8.0 or later · >= 1.1.0, < 2.8.0 · CVE-2026-25903 · GHSA-c5w7-m8wf-xc77
- High, CVSS 7.5
pretix unsafely evaluates variables in emails
PyPI pretix · Upgrade to 2026.1.1, 2025.10.2 or 2025.9.4 by release line · >= 2026.1.0, < 2026.1.1; >= 2025.10.0, < 2025.10.2; < 2025.9.4 · CVE-2026-2415 · GHSA-r8p8-qw9w-j9qv · amended
- Critical, CVSS 9.8
Known affected by Account Takeover via Password Reset Token Leakage
Packagist idno/known · Upgrade to 1.6.3 or later · <= 1.6.2 · CVE-2026-26273 · GHSA-78wq-6gcv-w28r
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.