Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
Packagist auth0/auth0-php · Upgrade to 8.19.0 or later · >= 8.0.0, <= 8.18.0 · CVE-2026-34236 · GHSA-w3wc-44p4-m4j7
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
8451–8475 of 31,057 matching · newest first
Packagist auth0/auth0-php · Upgrade to 8.19.0 or later · >= 8.0.0, <= 8.18.0 · CVE-2026-34236 · GHSA-w3wc-44p4-m4j7
PyPI open-webui · Upgrade to 0.8.11 or later · < 0.8.11 · CVE-2026-34222 · GHSA-7429-hxcv-268m · amended
Go github.com/steveiliop56/tinyauth · Upgrade to 1.0.1-0.20260401140714-fc1d4f2082a5 (pre-release) or later · < 1.0.1-0.20260401140714-fc1d4f2082a5 · CVE-2026-33544 · GHSA-9q5m-jfc4-wc92
Packagist devcode-it/openstamanager · Upgrade to 2.10.2 or later · <= 2.10.1 · CVE-2026-29782 · GHSA-whv5-4q2f-q68g
options[stato] ParameterPackagist devcode-it/openstamanager · Upgrade to 2.10.2 or later · <= 2.10.1 · CVE-2026-28805 · GHSA-3gw8-3mg3-jmpc
PyPI aiohttp · Upgrade to 3.13.4 or later · <= 3.13.3 · CVE-2026-22815 · GHSA-w2fm-2cpv-w7v5 · amended
PyPI changedetection-io · Upgrade to 0.54.7 or later · < 0.54.7 · CVE-2026-35000 · amended
Go go.temporal.io/server · Upgrade to 1.30.3 or 1.29.5 by release line · >= 1.30.0-143.0, < 1.30.3; < 1.29.5 · CVE-2026-5199 · GHSA-xpg8-3hhp-p7w8
npm payload +1 · Upgrade all 2 to 3.79.1 or later · < 3.79.1 · CVE-2026-34751 · GHSA-hp5w-3hxx-vmwf · amended
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260330031106-f09953afc57a (pre-release) or later · < 0.0.0-20260330031106-f09953afc57a · CVE-2026-34605 · GHSA-73g7-86qr-jrg3
FilesystemBridge Path Validation Can Be Bypassed via Symlinks or Junctionsnpm @tinacms/graphql · Upgrade to 2.2.2 or later · <= 2.2.0 · CVE-2026-34604 · GHSA-g9c2-gf25-3x67 · amended
Packagist yeswiki/yeswiki · Upgrade to 4.6.0 or later · < 4.6.0 · GHSA-5724-x3rh-5qqq
npm @tinacms/graphql · Upgrade to 2.2.2 or later · <= 2.2.1 · CVE-2026-34603 · GHSA-g87c-r2jp-293w · amended
Packagist yeswiki/yeswiki · Upgrade to 4.6.0 or later · < 4.6.0 · CVE-2026-34598 · GHSA-37fq-47qj-6j5j
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34557 · GHSA-rpjr-985c-qhvm
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-34558 · GHSA-v77r-xg3p-75g7
npm parse-server · Upgrade to 9.7.0-alpha.16 (pre-release) or 8.6.70 by release line · >= 9.0.0, < 9.7.0-alpha.16; < 8.6.70 · CVE-2026-34595 · GHSA-mmg8-87c5-jrc2 · amended
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260329142331-918d1bd9f967 (pre-release) or later · < 0.0.0-20260329142331-918d1bd9f967 · CVE-2026-34585 · GHSA-ff66-236v-p4fg
PyPI torchgeo · Upgrade to 0.6.1 or later · >= 0.4, <= 0.6.0 · CVE-2024-49048 · GHSA-ghq9-vc6f-8qjf · amended
npm parse-server · Upgrade to 9.7.0-alpha.14 (pre-release) or 8.6.69 by release line · >= 9.0.0, < 9.7.0-alpha.14; < 8.6.69 · CVE-2026-34574 · GHSA-f6j3-w9v3-cq22 · amended
.env environment variable injection which bypasses host-env policy and allows config takeovernpm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-41294 · GHSA-8rh7-6779-cjqq · amended
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-41380 · GHSA-p4x4-2r7f-wjxg · amended
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-34504 · GHSA-qxgf-hmcj-3xw3 · amended
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-33578 · GHSA-63mg-xp9j-jfcm · amended
operator.write can reach admin-only session reset via chat.send /resetnpm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-41371 · GHSA-5r8f-96gm-5j6g · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.