High, CVSS 7.5
PYSEC-2026-2199
PyPI lollms · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-0560
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
8576–8600 of 31,057 matching · newest first
- Critical, CVSS 9.8
PYSEC-2026-2198
PyPI lollms · Upgrade to 2.1.1 or later · < 2.1.1 · CVE-2026-0558
- Medium, CVSS 5.3
OpenClaw has ACP CLI approval prompt ANSI escape sequence injection
npm openclaw · Upgrade to 2026.3.28 or later · >= 2026.2.13, <= 2026.3.24 · CVE-2026-35651 · GHSA-4hmj-39m8-jwc7 · amended
- Medium, CVSS 6.9
OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-35661 · GHSA-j4c9-w69r-cw33 · amended
- Medium, CVSS 6.3
OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token
npm openclaw · Upgrade to 2026.3.28 or later · < 2026.3.28 · CVE-2026-35646 · GHSA-mf5g-6r6f-ghhm · amended
- Unrated
OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-35654 · GHSA-rf6h-5gpw-qrgq · amended
- Medium, CVSS 6.1
OpenClaw: Gateway Plugin Subagent Fallback
deleteSessionUses Syntheticoperator.adminnpm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-35645 · GHSA-h4jx-hjr3-fhgc · amended
- Unrated
OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-35664 · GHSA-77w2-crqv-cmv3 · amended
- Medium, CVSS 6.9
OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation
npm openclaw · Upgrade to 2026.3.28 or later · < 2026.3.28 · CVE-2026-35640 · GHSA-3h52-cx59-c456 · amended
- Unrated
OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)
npm openclaw · Upgrade to 2026.3.28 or later · < 2026.3.28 · CVE-2026-35629 · GHSA-rhfg-j8jq-7v2h · amended
- Low, CVSS 2.3
OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName
npm openclaw · Upgrade to 2026.3.28 or later · <= 2026.3.24 · CVE-2026-35617 · GHSA-52q4-3xjc-6778 · amended
- Unrated
OpenClaw:
session_statussessionId resolution bypasses sandboxed session-tree visibilitynpm openclaw · Upgrade to 2026.3.28 or later · >= 2026.3.11, <= 2026.3.24 · CVE-2026-35636 · GHSA-q2qc-744p-66r2 · amended
- Medium, CVSS 5.3
OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope
npm openclaw · Upgrade to 2026.3.25 or later · <= 2026.3.24 · CVE-2026-35657 · GHSA-5jvj-hxmh-6h6j · amended
- High, CVSS 8.3
MikroORM has Prototype Pollution in Utils.merge
npm @mikro-orm/core · Upgrade to 7.0.6 or 6.6.10 by release line · < 6.6.10; >= 7.0.0-dev.0, < 7.0.6 · CVE-2026-34221 · GHSA-qpfv-44f3-qqx6 · amended
- Critical, CVSS 9.3
MikroORM is vulnerable to SQL Injection via specially crafted object
npm @mikro-orm/core · Upgrade to 7.0.6 or 6.6.10 by release line · < 6.6.10; >= 7.0.0-dev.0, < 7.0.6 · CVE-2026-34220 · GHSA-gwhv-j974-6fxm · amended
- High, CVSS 7.8
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)
Go github.com/traefik/traefik/v3 · Upgrade to 3.7.0-ea.3 (pre-release) or 3.6.12 by release line · >= 3.0.0-beta3, < 3.6.12; >= 3.7.0-ea.1, < 3.7.0-ea.3 · +1 more package · GHSA-46wh-3698-f2cx
- Medium, CVSS 6.5
OpenCC has an Out-of-bounds read when processing truncated UTF-8 input
npm opencc +1 · Upgrade all 2 to 1.2.0 or later · < 1.2.0 · GHSA-7fqq-q52p-2jjg · amended
- High, CVSS 7.5
Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies
npm happy-dom · Upgrade to 20.8.9 or later · < 20.8.9 · CVE-2026-34226 · GHSA-w4gp-fjgq-3q4g · amended
- Low, CVSS 2.1
Parse Server has an MFA single-use token bypass via concurrent authData login requests
npm parse-server · Upgrade to 9.7.0-alpha.8 (pre-release) or 8.6.64 by release line · >= 9.0.0, < 9.7.0-alpha.8; < 8.6.64 · CVE-2026-34224 · GHSA-w73w-g5xw-rwhf · amended
- Low, CVSS 2.1
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
npm trix +1 · Upgrade all 2 to 2.1.18 or later · < 2.1.18 · CVE-2026-73427 · GHSA-53p3-c7vp-4mcc · amended
- Critical, CVSS 9.3
mpp has multiple payment bypass and griefing vulnerabilities
crates.io mpp · Upgrade to 0.8.0 or later · < 0.8.0 · GHSA-fxc9-7j2w-vx54
- High, CVSS 7.5
XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion
Go github.com/antchfx/xpath · Upgrade to 1.3.6 or later · < 1.3.6 · CVE-2026-32287 · GHSA-65xw-vw82-r86x
- Medium, CVSS 4.8
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
npm handlebars · Upgrade to 4.7.9 or later · >= 4.6.0, <= 4.7.8 · GHSA-7rx3-28cr-v5wh · amended
- Low, CVSS 3.7
Handlebars.js has a Property Access Validation Bypass in container.lookup
npm handlebars · Upgrade to 4.7.9 or later · >= 4.0.0, <= 4.7.8 · GHSA-442j-39wm-28r2 · amended
- Critical, CVSS 9.3
mppx has multiple payment bypass and griefing vulnerabilities
npm mppx · Upgrade to 0.4.8 or later · < 0.4.8 · GHSA-8x4m-qw58-3pcx · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.