Medium, CVSS 5.7
OpenClaw session transcript files were created without forced user-only permissions
npm openclaw · Upgrade to 2026.2.17 or later · <= 2026.2.15 · CVE-2026-33572 · GHSA-vr7j-g7jv-h5mp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9126–9150 of 31,071 matching · newest first
- High, CVSS 7.2
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
npm openclaw · Upgrade to 2026.3.13 or later · <= 2026.3.12 · CVE-2026-32917 · GHSA-g2f6-pwvx-r275 · amended
- High, CVSS 8.7
OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion
npm openclaw · Upgrade to 2026.3.13 or later · <= 2026.3.12 · CVE-2026-32980 · GHSA-jq3f-vjww-8rq7 · amended
- High, CVSS 8.6
OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval
npm openclaw · Upgrade to 2026.3.13 or later · <= 2026.3.12 · CVE-2026-32987 · GHSA-63f5-hhc7-cx6p · amended
- Medium, CVSS 6.9
OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs
npm openclaw · Upgrade to 2026.3.13 or later · <= 2026.3.12 · CVE-2026-32982 · GHSA-xwcj-hwhf-h378 · amended
- High, CVSS 8.3
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
npm parse-server · Upgrade to 9.6.0-alpha.15 (pre-release) or 8.6.41 by release line · >= 9.0.0, < 9.6.0-alpha.15; < 8.6.41 · CVE-2026-32728 · GHSA-42ph-pf9q-cr72 · amended
- High, CVSS 8.7
Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability
Packagist craftcms/azure-blob · Upgrade to 2.1.1 or later · >= 2.0.0-beta.1, <= 2.1.0 · CVE-2026-32268 · GHSA-q6fm-p73f-x862
- High, CVSS 7.7
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
Packagist craftcms/cms · Upgrade to 5.9.12 or 4.17.6 by release line · >= 4.0.0-RC1, <= 4.17.5; >= 5.0.0-RC1, <= 5.9.11 · CVE-2026-32267 · GHSA-cc7p-2j3x-x7xf
- High, CVSS 7.5
GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute
Go github.com/osrg/gobgp/v4 · Upgrade to 4.4.0 or later · <= 4.3.0 · CVE-2026-30405 · GHSA-4p9m-8gc4-rw2h
- Low, CVSS 2.4
Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability
Packagist craftcms/google-cloud · Upgrade to 2.2.1 or later · >= 2.0.0-beta.1, <= 2.2.0 · CVE-2026-32266 · GHSA-67cr-jmh8-4jpq
- Medium, CVSS 6.9
Amazon S3 for Craft CMS has an Information Disclosure vulnerability
Packagist craftcms/aws-s3 · Upgrade to 2.2.5 or later · >= 2.0.2, <= 2.2.4 · CVE-2026-32265 · GHSA-hwj7-4vgc-j3v9
- High, CVSS 8.6
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
Packagist craftcms/cms · Upgrade to 5.9.11 or 4.17.5 by release line · >= 4.0.0-RC1, <= 4.17.4; >= 5.0.0-RC1, <= 5.9.10 · CVE-2026-32264 · GHSA-4484-8v2f-5748
- High, CVSS 8.6
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
Packagist craftcms/cms · Upgrade to 5.9.11 or later · >= 5.6.0, <= 5.9.10 · CVE-2026-32263 · GHSA-qx2q-q59v-wf3j
- Medium, CVSS 5.3
Craft CMS has a Path Traversal Vulnerability in AssetsController
Packagist craftcms/cms · Upgrade to 5.9.11 or 4.17.5 by release line · >= 4.0.0-RC1, <= 4.17.4; >= 5.0.0-RC1, <= 5.9.10 · CVE-2026-32262 · GHSA-472v-j2g4-g9h2
- High, CVSS 8.5
RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin
Packagist craftcms/webhooks · Upgrade to 3.2.0 or later · >= 3.0.0, < 3.2.0 · CVE-2026-32261 · GHSA-8wg7-wm29-2rvg
- Medium, CVSS 4.8
SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers
npm @nyariv/sandboxjs · Upgrade to 0.8.35 or later · <= 0.8.34 · CVE-2026-32723 · GHSA-7p5m-xrh7-769r · amended
- Low, CVSS 3.6
Stored XSS in Memray-generated HTML reports via unescaped command-line metadata
PyPI memray · Upgrade to 1.19.2 or later · < 1.19.2 · CVE-2026-32722 · GHSA-r5pr-887v-m2w9 · amended
- Unrated
XSS in @leanprover/unicode-input-component
npm @leanprover/unicode-input-component · Upgrade to 0.2.0 or later · < 0.2.0 · CVE-2026-32732 · GHSA-6ggm-pwr9-r5h2 · amended
- Low, CVSS 2.7
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
npm studiocms · Upgrade to 0.4.4 or later · <= 0.4.3 · CVE-2026-32638 · GHSA-xvf4-ch4q-2m24 · amended
- High, CVSS 8.1
Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers
PyPI glances · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-32634 · GHSA-vx5f-957p-qpvm · amended
- Critical, CVSS 9.1
Glances's Browser API Exposes Reusable Downstream Credentials via
/api/4/serverslistPyPI glances · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-32633 · GHSA-r297-p3v4-wp8m · amended
- Medium, CVSS 5.9
Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
PyPI glances · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-32632 · GHSA-hhcg-r27j-fhv9 · amended
- High, CVSS 7.0
Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
PyPI glances · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-32611 · GHSA-49g7-2ww7-3vf5 · amended
- High, CVSS 8.1
Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
PyPI glances · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-32610 · GHSA-9jfm-9rc6-2hfq · amended
- High, CVSS 7.5
Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
PyPI glances · Upgrade to 4.5.2 or later · < 4.5.2 · CVE-2026-32609 · GHSA-cvwp-r2g2-j824 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.