Medium, CVSS 5.3
OpenClaw has a Gateway HTTP /v1/models Route Bypasses Operator Read Scope
npm openclaw · Upgrade to 2026.3.24 or later · <= 2026.3.23 · CVE-2026-35619 · GHSA-68f8-9mhj-h2mp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8551–8575 of 31,057 matching · newest first
- Medium, CVSS 6.9
OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant)
npm openclaw · Upgrade to 2026.3.24 or later · < 2026.3.24 · CVE-2026-35665 · GHSA-w6m8-cqvj-pg5v · amended
- High, CVSS 7.7
OpenClaw has Sandbox Media Root Bypass via Unnormalized
mediaUrl/fileUrlParameter Keys (CWE-22)npm openclaw · Upgrade to 2026.3.24 or later · < 2026.3.24 · CVE-2026-35668 · GHSA-hr5v-j9h9-xjhg · amended
- Medium, CVSS 6.1
OpenClaw has incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in
!stopChat Command viashell-utils.tsnpm openclaw · Upgrade to 2026.3.24 or later · < 2026.3.24 · CVE-2026-35667 · GHSA-3298-56p6-rpw2 · amended
- Medium, CVSS 5.3
GraphQL API endpoint ignores CORS origin restriction
npm parse-server · Upgrade to 9.7.0-alpha.10 (pre-release) or 8.6.66 by release line · >= 9.0.0, < 9.7.0-alpha.10; >= 3.5.0, < 8.6.66 · CVE-2026-34373 · GHSA-q3p6-g7c4-829c · amended
- Medium, CVSS 5.3
Sulu checks fix permissions for subentities endpoints
Packagist sulu/sulu · Upgrade to 3.0.5 or 2.6.22 by release line · >= 1.0.0, < 2.6.22; >= 3.0.0, < 3.0.5 · CVE-2026-34372 · GHSA-6h7h-m7p5-hjqp
- High, CVSS 8.2
LiveQuery protected field leak via shared mutable state across concurrent subscribers
npm parse-server · Upgrade to 9.7.0-alpha.9 (pre-release) or 8.6.65 by release line · >= 9.0.0, < 9.7.0-alpha.9; < 8.6.65 · CVE-2026-34363 · GHSA-m983-v2ff-wq65 · amended
- Medium, CVSS 6.1
MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
Maven io.modelcontextprotocol.sdk:mcp-core · Upgrade to 1.1.1, 1.0.1 or 0.18.3 by release line · >= 1.1.0, <= 1.1.0; >= 1.0.0, <= 1.0.0; < 0.18.3 · CVE-2026-34237 · GHSA-hv2w-8mjj-jw22
- Critical, CVSS 9.3
FHIR Validator HTTP service has SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft
Maven ca.uhn.hapi.fhir:org.hl7.fhir.validation · Upgrade to 6.9.4 or later · < 6.9.4 · CVE-2026-34361 · GHSA-vr79-8m62-wh98
- Medium, CVSS 5.8
FHIR Validator: Unauthenticated Blind SSRF via /loadIG Endpoint Enables Internal Network Probing
Maven ca.uhn.hapi.fhir:org.hl7.fhir.core · Upgrade to 6.9.4 or later · < 6.9.4 · CVE-2026-34360 · GHSA-3ww8-jw56-9f5h
- Medium, CVSS 6.1
Slippers Vulnerable to Cross-Site Scripting (XSS) in
attrsTemplate TagPyPI slippers · Upgrade to 0.6.3 or later · <= 0.6.2 · CVE-2026-34231 · GHSA-w7rv-gfp4-j9j3 · amended
- High, CVSS 7.4
HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect
Maven ca.uhn.hapi.fhir:org.hl7.fhir.utilities +1 · Upgrade all 2 to 6.9.4 or later · < 6.9.4 · CVE-2026-34359 · GHSA-fgv2-4q4g-wc35
- Medium, CVSS 5.0
go-git: Maliciously crafted idx file can cause asymmetric memory consumption
Go github.com/go-git/go-git/v5 · Upgrade to 5.17.1 or later · >= 5.0.0, <= 5.17.0 · CVE-2026-34165 · GHSA-jhf3-xxhw-2wpp
- Critical, CVSS 9.9
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
npm @nocobase/plugin-workflow-javascript · Upgrade to 2.0.28 or later · <= 2.0.27 · CVE-2026-34156 · GHSA-px3p-vgh9-m57c · amended
- Medium, CVSS 6.8
Docker Model Runner OCI Registry Client Vulnerable to Server-Side Request Forgery (SSRF)
Go github.com/docker/model-runner · Upgrade to 1.1.25 or later · < 1.1.25 · CVE-2026-33990 · GHSA-x2f5-332j-9xwq
- High, CVSS 8.1
@tinacms/graphql has Path Traversal that leads to overwrite of arbitrary files
npm @tinacms/graphql · Upgrade to 2.2.2 or later · <= 2.2.1 · CVE-2026-33949 · GHSA-v9p7-gf3q-h779 · amended
- Low, CVSS 2.8
go-git missing validation decoding Index v4 files leads to panic
Go github.com/go-git/go-git/v5 · Upgrade to 5.17.1 or later · < 5.17.1 · CVE-2026-33762 · GHSA-gm2x-2g9h-ccm8 · amended
- High, CVSS 7.8
Glances Vulnerable to Command Injection via Dynamic Configuration Values
PyPI glances · Upgrade to 4.5.3 or later · <= 4.5.2 · CVE-2026-33641 · GHSA-qhj7-v7h7-q4c7 · amended
- High, CVSS 7.1
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
PyPI glances · Upgrade to 4.5.3 or later · < 4.5.3 · CVE-2026-33533 · GHSA-7p93-6934-f4q7 · amended
- Critical, CVSS 9.4
nginx-ui Backup Restore Allows Tampering with Encrypted Backups
Go github.com/0xJacky/Nginx-UI · Upgrade to 1.9.10-0.20260315015203-f61bcec547c0 (pre-release) or later · < 1.9.10-0.20260315015203-f61bcec547c0 · CVE-2026-33026 · GHSA-fhh2-gg7w-gwpq
- Critical, CVSS 9.1
ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Packagist ci4-cms-erp/ci4ms · Upgrade to 0.31.0.0 or later · <= 0.28.6.0 · CVE-2026-27599 · GHSA-66m2-v9v9-95c3
- High, CVSS 8.2
libp2p-gossipsub: Remote crash via unchecked Instant overflow in heartbeat backoff expiry handling
crates.io libp2p-gossipsub · Upgrade to 0.49.4 or later · < 0.49.4 · CVE-2026-34219 · GHSA-xqmp-fxgv-xvq5 · amended
- Critical, CVSS 10.0
MLflow Command Injection vulnerability
PyPI mlflow · Upgrade to 3.8.1 or later · < 3.8.1 · CVE-2025-15379 · GHSA-r23q-823p-vmf7 · amended
- Critical, CVSS 9.6
MLFlow path traversal vulnerability
PyPI mlflow · Upgrade to 3.9.0rc0 (pre-release) or later · < 3.9.0rc0 · CVE-2025-15036 · GHSA-vhcx-3pq2-4fvc · amended
- High, CVSS 8.3
PYSEC-2026-204
PyPI lollms · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-0562
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.