Critical, CVSS 9.3
Linkdave Missing Authentication on REST and WebSocket endpoints
Go github.com/shi-gg/linkdave · Upgrade to 0.1.5 or later · < 0.1.5 · GHSA-xv8g-fj9h-6gmv
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9426–9450 of 31,071 matching · newest first
- Medium, CVSS 5.3
OneUptime has WhatsApp Resend Verification Authorization Bypass
npm @oneuptime/common · Upgrade to 10.0.21 or later · < 10.0.21 · CVE-2026-30959 · GHSA-cw6x-mw64-q6pv · amended
- Critical, CVSS 9.9
OneUptime has Synthetic Monitor RCE via exposed Playwright browser object
npm @oneuptime/common · Upgrade to 10.0.21 or later · < 10.0.21 · CVE-2026-30957 · GHSA-jw8q-gjvg-8w4q · amended
- Critical, CVSS 9.9
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover
npm @oneuptime/common · Upgrade to 10.0.21 or later · < 10.0.21 · CVE-2026-30956 · GHSA-r5v6-2599-9g3m · amended
- High, CVSS 8.7
liquidjs has a path traversal fallback vulnerability
npm liquidjs · Upgrade to 10.25.0 or later · < 10.25.0 · CVE-2026-30952 · GHSA-wmfp-5q7x-987x · amended
- Medium, CVSS 5.3
Actual Sync Server has an Authenticated Path Traversal
npm @actual-app/sync-server · Upgrade to 26.3.0 or later · <= 26.2.0 · CVE-2026-3089 · GHSA-27vg-33gh-4hwg · amended
- High, CVSS 8.8
Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
npm parse-server · Upgrade to 9.5.1-alpha.2 (pre-release) or 8.6.13 by release line · < 8.6.13; >= 9.0.0-alpha.1, < 9.5.1-alpha.2 · CVE-2026-30939 · GHSA-5j86-7r7m-p8h6 · amended
- Medium, CVSS 6.9
Parse Server has denylist
requestKeywordDenylistkeyword scan bypass through nested object placementnpm parse-server · Upgrade to 9.5.1-alpha.1 (pre-release) or 8.6.12 by release line · < 8.6.12; >= 9.0.0-alpha.1, < 9.5.1-alpha.1 · CVE-2026-30938 · GHSA-q342-9w2p-57fp · amended
- High, CVSS 8.2
Parse Server has Regular Expression Denial of Service (ReDoS) via
$regexquery in LiveQuerynpm parse-server · Upgrade to 9.5.0-alpha.14 (pre-release) or 8.6.11 by release line · >= 9.0.0-alpha.1, < 9.5.0-alpha.14; < 8.6.11 · CVE-2026-30925 · GHSA-mf3j-86qx-cq5j · amended
- Medium, CVSS 4.6
flarum/nicknames extension has display name injection in notification emails (autolink & markdown)
Packagist flarum/nicknames · Upgrade to 1.8.3 or later · < 1.8.3 · CVE-2026-30913 · GHSA-3c4m-j3g4-hh25
- High, CVSS 8.6
NLTK has Arbitrary File Read via Absolute Path Input in nltk.util.filestring()
PyPI nltk · Upgrade to 3.9.3 or later · < 3.9.3 · CVE-2026-0846 · GHSA-h8wq-7xc4-p3qx · amended
- Medium, CVSS 5.4
vLLM has SSRF Protection Bypass
PyPI vllm · Upgrade to 0.17.0 or later · >= 0.15.1, < 0.17.0 · CVE-2026-25960 · GHSA-v359-jj2v-j536 · amended
- High, CVSS 8.7
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
Packagist azuracast/azuracast · Upgrade to 0.23.4 or later · <= 0.23.3 · GHSA-93fx-5qgc-wr38
- Medium, CVSS 5.8
OpenClaw: Sandboxed /acp spawn requests could initialize host ACP sessions
npm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · CVE-2026-27646 · GHSA-9q36-67vc-rrwg · amended
- Medium, CVSS 5.0
OpenClaw: system.run allow-always persistence included shell-commented payload tails
npm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · GHSA-9q2p-vc84-2rwm · amended
- Medium, CVSS 4.3
OpenClaw:
operator.writechat.send could reach admin-only config writesnpm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · GHSA-hfpr-jhpq-x4rm · amended
- Low, CVSS 2.1
OpenClaw: system.run wrapper-depth boundary could skip shell approval gating
npm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · CVE-2026-27183 · GHSA-r6qf-8968-wj9q · amended
- High, CVSS 8.8
OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects
npm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · CVE-2026-32913 · GHSA-6mgf-v5j7-45cr · amended
- Medium, CVSS 5.4
OpenClaw: Cross-account sender authorization expansion in
/allowlist ... --storeaccount scopingnpm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · GHSA-pjvx-rx66-r3fg · amended
- Medium, CVSS 5.0
OpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers
npm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · GHSA-3h2q-j2v4-6w5r · amended
- Medium, CVSS 6.3
OpenClaw's
system.runenv override filtering allowed dangerous helper-command pivotsnpm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · GHSA-j425-whc4-4jgc · amended
- Medium, CVSS 5.3
OpenClaw's hooks count non-POST requests toward auth lockout
npm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · GHSA-6rmx-gvvg-vh6j · amended
- High, CVSS 7.1
OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage
npm openclaw · Upgrade to 2026.3.7 or later · <= 2026.3.2 · GHSA-rchv-x836-w7xp · amended
- High, CVSS 7.3
Glances has SQL Injection via Process Names in TimescaleDB Export
PyPI glances · Upgrade to 4.5.1 or later · < 4.5.1 · CVE-2026-30930 · GHSA-x46r-mf5g-xpr6 · amended
- High, CVSS 8.7
Glances Exposes Unauthenticated Configuration Secrets
PyPI glances · Upgrade to 4.5.1 or later · < 4.5.1 · CVE-2026-30928 · GHSA-gh4x-f7cq-wwx6 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.