Medium, CVSS 6.9
Apache Cassandra has sensitive Information Leak in cqlsh
Maven org.apache.cassandra:cassandra-all · Upgrade to 4.0.20 or later · >= 4.0, < 4.0.20 · CVE-2026-27315 · GHSA-fh34-c629-p8xj
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8126–8150 of 31,057 matching · newest first
- High, CVSS 8.8
Apache Cassandra is vulnerable to privilege escalation in an mTLS environment using MutualTlsAuthenticator
Maven org.apache.cassandra:cassandra-all · Upgrade to 5.0.7 or later · >= 5.0-alpha1, < 5.0.7 · CVE-2026-27314 · GHSA-qxpc-96fq-wwmg
- Critical, CVSS 9.8
Memory-safety vulnerability in github.com/jackc/pgx/v5.
Go github.com/jackc/pgx/v5 · Upgrade to 5.9.0 or later · < 5.9.0 · CVE-2026-33816 · GHSA-9jj7-4m8r-rfcm
- Critical, CVSS 9.8
pgx contains memory-safety vulnerability
Go github.com/jackc/pgx/v5 · Upgrade to 5.9.0 or later · < 5.9.0 · CVE-2026-33815 · GHSA-xgrm-4fwx-7qm8
- High, CVSS 8.8
Gotenberg has incomplete fix for ExifTool arbitrary file write: case-insensitive bypass and missing HardLink/SymLink tags
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.30.0 or later · <= 8.29.1 · GHSA-qmwh-9m9c-h36m
- High, CVSS 8.7
Gotenberg Vulnerable to ReDoS via extraHttpHeaders scope feature
Go github.com/gotenberg/gotenberg/v8 · Upgrade to 8.30.0 or later · <= 8.29.1 · CVE-2026-35458 · GHSA-fmwg-qcqh-m992
- Medium, CVSS 6.3
OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-40045 · GHSA-83f3-hh45-vfw9 · amended
- Medium, CVSS 6.3
OpenClaw: Shared-secret comparison call sites leaked length information through timing
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-41407 · GHSA-jj6q-rrrf-h66h · amended
- Medium, CVSS 6.3
OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-41354 · GHSA-rxmx-g7hr-8mx4 · amended
- Medium, CVSS 6.9
OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-41372 · GHSA-fh32-73r9-rgh5 · amended
- Medium, CVSS 6.9
OpenClaw: pnpm dlx approvals did not bind local script operands
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-41360 · GHSA-w6wx-jq6j-6mcj · amended
- Medium, CVSS 6.9
OpenClaw: Windows-compatible env override keys could bypass system.run approval binding
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-34426 · GHSA-98ch-45wp-ch47 · amended
- Medium, CVSS 5.3
OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-41339 · GHSA-2f7j-rp58-mr42 · amended
- Medium, CVSS 6.3
OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-41295 · GHSA-2qrv-rc5x-2g2h · amended
- Medium, CVSS 5.3
OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-41298 · GHSA-5hff-46vh-rxmw · amended
- Medium, CVSS 6.9
OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-41398 · GHSA-4p4f-fc8q-84m3 · amended
- Medium, CVSS 6.9
OpenClaw: QQ Bot structured payloads could read arbitrary local files
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · GHSA-846p-hgpv-vphc · amended
- Medium, CVSS 6.9
OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped
npm openclaw · Upgrade to 2026.4.2 or later · <= 2026.4.1 · CVE-2026-41383 · GHSA-m34q-h93w-vg5x · amended
- Low, CVSS 2.3
OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets
npm openclaw · Upgrade to 2026.3.31 or later · >= 2026.2.19, < 2026.3.31 · CVE-2026-41362 · GHSA-fqrj-m88p-qf3v · amended
- Medium, CVSS 6.3
OpenClaw: Pairing pending-request caps were enforced per channel instead of per account
npm openclaw · Upgrade to 2026.3.31 or later · >= 2026.2.26, < 2026.3.31 · CVE-2026-41346 · GHSA-wwfp-w96m-c6x8 · amended
- Medium, CVSS 6.9
OpenClaw: Forged Nostr DMs could create pairing state before signature verification
npm openclaw · Upgrade to 2026.3.31 or later · >= 2026.3.22, < 2026.3.31 · CVE-2026-41301 · GHSA-h43v-27wg-5mf9 · amended
- Medium, CVSS 6.3
OpenClaw: Shell init-file options could satisfy exec allowlist script matching
npm openclaw · Upgrade to 2026.3.31 or later · < 2026.3.31 · CVE-2026-41392 · GHSA-wpc6-37g7-8q4w · amended
- Medium, CVSS 5.4
OpenClaw: OpenShell
mirrormode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startupnpm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-41355 · GHSA-42mx-vp8m-j7qh · amended
- High, CVSS 7.1
OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-41359 · GHSA-767m-xrhc-fxm7 · amended
- Medium, CVSS 6.3
OpenClaw:
session_statusstill bypasses configuredtools.sessions.visibilityfor unsandboxed invocationsnpm openclaw · Upgrade to 2026.3.31 or later · <= 2026.3.28 · CVE-2026-41350 · GHSA-fwjq-xwfj-gv75 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.