High, CVSS 7.5
CairoSVG vulnerable to Exponential DoS via recursive element amplification
PyPI cairosvg · Upgrade to 2.9.0 or later · <= 2.8.2 · CVE-2026-31899 · GHSA-f38f-5xpm-9r7c · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9226–9250 of 31,071 matching · newest first
- High, CVSS 8.7
Yamux vulnerable to remote Panic via malformed WindowUpdate credit
crates.io yamux · Upgrade to 0.13.9 or later · >= 0.13.0, < 0.13.9 · CVE-2026-31814 · GHSA-4w32-2493-32g7
- Medium, CVSS 4.3
Gokapi's File Request MaxSize Limit Bypassed via Multi-Chunk Upload
Go github.com/forceu/gokapi · Upgrade to 2.2.4 or later · <= 2.2.3 · CVE-2026-30961 · GHSA-45vh-rpc8-hxpp
- Medium, CVSS 6.5
Gokapi vulnerable to DoS in E2E Metadata Parser
Go github.com/forceu/gokapi · Upgrade to 2.2.4 or later · <= 2.2.3 · CVE-2026-30955 · GHSA-qwc6-vc2v-2ggj
- Medium, CVSS 4.1
Gokapi vulnerable to Privilege Escalation in File Replace
Go github.com/forceu/gokapi · Upgrade to 2.2.4 or later · <= 2.2.3 · CVE-2026-30943 · GHSA-j6jp-78w8-34x6
- Medium, CVSS 6.9
SFTPGo improperly sanitizes placeholders in group home directories/key prefixes
Go github.com/drakkan/sftpgo/v2 · Upgrade to 2.7.1 or later · >= 2.3.0, <= 2.7.0 · CVE-2026-30915 · GHSA-m83q-5wr4-4gfp
- Critical, CVSS 9.8
Locutus vulnerable to RCE via unsanitized input in create_function()
npm locutus · Upgrade to 3.0.14 or later · <= 3.0.13 · CVE-2026-32304 · GHSA-vh9h-29pq-r5m8 · amended
- Critical, CVSS 9.2
SM9 Infinity-Point Ciphertext Forgery Vulnerability
Go github.com/emmansun/gmsm · Upgrade to 0.41.1 or later · < 0.41.1 · CVE-2026-32614 · GHSA-5xxp-2vrj-x855
- Low, CVSS 2.5
OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32970 · GHSA-qvr7-g57c-mrc7 · amended
- High, CVSS 7.5
OpenClaw: Sandbox staged writes could escape the verified parent directory before commit
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32988 · GHSA-mj4p-rc52-m843 · amended
- Medium, CVSS 6.1
OpenClaw: Write-scoped callers could reach admin-only session reset logic through
agentnpm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32919 · GHSA-jf6w-m8jw-jfxc · amended
- High, CVSS 8.0
OpenClaw: Unrecognized script runners could bypass
system.runapproval integritynpm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32978 · GHSA-qc36-x95h-7j53 · amended
- Medium, CVSS 6.5
OpenClaw: Channel commands could bypass account-scoped
configWritesrestrictionsnpm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32976 · GHSA-8jhh-jcqg-mj5p · amended
- High, CVSS 7.1
OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32971 · GHSA-rw39-5899-8mxp · amended
- High, CVSS 7.3
OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32979 · GHSA-xf99-j42q-5w5p · amended
- High, CVSS 8.8
OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries
npm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32915 · GHSA-4w7m-58cg-cmff · amended
- Critical, CVSS 9.9
OpenClaw: Pairing-scoped device tokens could mint
operator.adminand reach node RCEnpm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32922 · GHSA-4jpw-hj22-2xmc · amended
- Critical, CVSS 9.4
OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes
npm openclaw · Upgrade to 2026.3.11 or later · >= 2026.3.7, < 2026.3.11 · CVE-2026-32916 · GHSA-xw77-45gv-p728 · amended
- Medium, CVSS 6.3
OpenClaw: Sandbox
writeFilecommit could race outside the validated pathnpm openclaw · Upgrade to 2026.3.11 or later · < 2026.3.11 · CVE-2026-32977 · GHSA-xvx8-77m6-gwg6 · amended
- High, CVSS 7.5
flatted vulnerable to unbounded recursion DoS in parse() revive phase
npm flatted · Upgrade to 3.4.0 or later · < 3.4.0 · CVE-2026-32141 · GHSA-25h7-pfq9-p65f · amended
- High, CVSS 8.7
Poseidon V1 variable-length input collision via implicit zero-padding
crates.io soroban-poseidon · Upgrade to 25.0.1 or later · < 25.0.1 · CVE-2026-32129 · GHSA-g2p6-hh5v-7hfm
- High, CVSS 8.2
Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
PyPI magic-wormhole · Upgrade to 0.23.0 or later · >= 0.21.0, < 0.23.0 · CVE-2026-32116 · GHSA-4g4c-mfqg-pj8r · amended
- High, CVSS 7.5
Dagu: SSE Authentication Bypass in Basic Auth Mode
npm dagu · Upgrade to 2.2.4 or later · < 2.2.4 · CVE-2026-31882 · GHSA-9wmw-9wph-2vwp · amended
- Critical, CVSS 10.0
SandboxJS affected by a Sandbox Escape
npm @nyariv/sandboxjs · Upgrade to 0.8.34 or later · <= 0.8.33 · CVE-2026-26954 · GHSA-6r9f-759j-hjgv · amended
- Medium, CVSS 6.5
Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings
Go github.com/ellanetworks/core · Upgrade to 1.5.1 or later · < 1.5.1 · CVE-2026-32320 · GHSA-j478-p7vq-3347
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.