High, CVSS 7.0
OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
npm openclaw · Upgrade to 2026.5.2 or later · < 2026.5.2 · CVE-2026-53842 · GHSA-fq9j-vw4w-fr6v · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 965 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,080 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
5076–5100 of 30,970 matching · newest first
- High, CVSS 7.6
OpenClaw: Shell inline-command parsing could miss an allowlist check
npm openclaw · Upgrade to 2026.5.12 or later · <= 2026.5.10-beta.1 · CVE-2026-53866 · GHSA-f397-5vjw-v2c2 · amended
- High, CVSS 8.8
OpenClaw: Pairing-scoped device session could restore revoked node token authority
npm openclaw · Upgrade to 2026.5.26 or later · < 2026.5.26 · CVE-2026-53843 · GHSA-q99w-vh6v-q3v7 · amended
- High, CVSS 7.6
OpenClaw: Host environment sanitizer missed two Node.js control variables
npm openclaw · Upgrade to 2026.5.26 or later · <= 2026.5.22 · CVE-2026-53864 · GHSA-ccwh-wwpp-6wg5 · amended
- Low, CVSS 2.3
ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components
Go github.com/zitadel/zitadel · Upgrade to 1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2 (pre-release) or later · < 1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2 · CVE-2026-55671 · GHSA-29jh-8cfq-rr8x
- Medium, CVSS 5.1
marimo contains a reflected cross-site scripting vulnerability in the notebook page
PyPI marimo · Upgrade to 0.23.9 or later · < 0.23.9 · CVE-2026-54386 · GHSA-8m59-7xv8-735h · amended
- High, CVSS 8.7
Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation
PyPI hermes-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53869 · GHSA-4pqm-j46f-795x · amended
- Medium, CVSS 6.8
Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)
PyPI hermes-agent · Upgrade to 0.16.0 or later · < 0.16.0 · CVE-2026-53870 · GHSA-99f9-j8r3-p853 · amended
- Medium, CVSS 5.1
CakePHP Authentication: Open redirect weakness via backslash bypass
Packagist cakephp/authentication · Upgrade to 4.1.1, 3.3.6 or 2.11.1 by release line · >= 4.0.0, < 4.1.1; >= 3.0.0, < 3.3.6; < 2.11.1 · CVE-2026-55590 · GHSA-hhpq-7wg4-36jm
- Critical, CVSS 9.6
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
RubyGems avo · Upgrade to 4.0.0.beta.51 or 3.32.1 by release line · <= 3.32.0; >= 4.0.0.beta.1, < 4.0.0.beta.51 · CVE-2026-55518 · GHSA-8fq9-273g-6mrg
- Medium, CVSS 4.3
Deno: Denial of service via non-ASCII bytes in WebSocket response headers
crates.io deno · Upgrade to 2.7.5 or later · <= 2.7.4 · CVE-2026-55517 · GHSA-x2qc-cmh9-f4hf
- Critical, CVSS 9.2
HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory
Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities · Upgrade to 6.9.10 or later · <= 6.9.9 · CVE-2026-55471 · GHSA-2f55-g35j-5jmf
- High, CVSS 7.5
HAPI FHIR: Incomplete fix for CVE-2026-45367: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli +3 · Upgrade all 4 to 6.9.10 or later · <= 6.9.9 · CVE-2026-55470 · GHSA-fxj4-p9xp-37v5
- Critical, CVSS 9.3
Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak
PyPI langflow · Upgrade to 1.9.1 or later · < 1.9.1 · CVE-2026-55450 · GHSA-x223-p2gf-v735 · amended
- High, CVSS 7.5
handlebars.java FileTemplateLoader Path Traversal
Maven com.github.jknack:handlebars · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-55760 · GHSA-r4gv-qr8j-p3pg
- High, CVSS 7.6
Filament: Disabled RichEditor field state can be used for XSS
Packagist filament/forms · Upgrade to 3.3.53 or later · >= 3.0.0, < 3.3.53 · CVE-2026-55409 · GHSA-m9cv-24rx-8mv7 · amended
- High, CVSS 7.6
LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
Maven dev.langchain4j:langchain4j-mariadb +1 · Upgrade all 2 to 1.16.3-beta26 (pre-release), 1.11.8-beta19 (pre-release), 1.5.1-beta11 (pre-release) or 1.2.1-beta8 (pre-release) by release line · <= 1.2.0-beta8; >= 1.3.0-beta9, <= 1.5.0-beta11; >= 1.6.0-beta12, <= 1.11.7-beta19; >= 1.12.1-beta21, <= 1.16.2-beta26 · CVE-2026-55405 · GHSA-2mfg-cc43-9pcj
- Medium, CVSS 4.3
katello: missing repository authorization in content_uploads exposes cross-product content existence
RubyGems katello · Upgrade to 4.21.0.rc1 or later · < 4.21.0.rc1 · CVE-2026-12515 · GHSA-c43c-rf7g-5xpg
- High, CVSS 8.8
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
Maven org.apache.shiro:shiro-core · Upgrade to 3.0.0-alpha-2 (pre-release) or 2.2.1 by release line · < 2.2.1; >= 3.0.0-alpha-0, < 3.0.0-alpha-2 · CVE-2026-49268 · GHSA-x96m-rh44-vgv8
- Critical, CVSS 9.1
Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory
PyPI apache-airflow-providers-sftp · Upgrade to 5.8.1 or later · < 5.8.1 · CVE-2026-50203 · GHSA-qf38-jq28-3ccq · amended
- Medium, CVSS 6.5
Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.
Maven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-47340 · GHSA-694g-j8pj-cjj5
- Medium, CVSS 6.5
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
Maven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-42357 · GHSA-wv7f-c794-82v6
- Medium, CVSS 4.9
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
Maven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-41280 · GHSA-wh3w-v6gj-fqh2
- Critical, CVSS 9.1
Apache DolphinScheduler: The
/v2experimental interface lacks permission checksMaven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-32967 · GHSA-85g9-8j9g-p486
- Critical, CVSS 9.8
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
Maven org.apache.dolphinscheduler:dolphinscheduler-api · Upgrade to 3.4.2 or later · < 3.4.2 · CVE-2026-32966 · GHSA-r989-cjhx-3v49
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.