High, CVSS 8.9
OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs
npm openclaw · Upgrade to 2026.2.24 or later · <= 2026.2.23 · GHSA-9f72-qcpw-2hxc · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9726–9750 of 31,071 matching · newest first
- Medium, CVSS 6.4
OpenClaw's non-default safeBins sort configuration can bypass intended allowlist approval constraints
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · CVE-2026-22169 · GHSA-vmqr-rc7x-3446 · amended
- High, CVSS 8.3
OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths
npm openclaw · Upgrade to 2026.2.26 or later · <= 2026.2.25 · CVE-2026-32036 · GHSA-mwxv-35wr-4vvj · amended
- Medium, CVSS 6.9
OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes
npm openclaw · Upgrade to 2026.2.21 or later · < 2026.2.21 · CVE-2026-32045 · GHSA-hff7-ccv5-52f8 · amended
- Medium, CVSS 6.9
OpenClaw vulnerable to path traversal in Feishu media temp-file naming allows writes outside os.tmpdir()
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · CVE-2026-22171 · GHSA-vj3g-5px3-gr46 · amended
- Medium, CVSS 5.1
DOMPurify contains a Cross-site Scripting vulnerability
npm dompurify · Upgrade to 3.2.7; some affected versions have no fix yet · >= 3.1.3, < 3.2.7; >= 2.5.3, <= 2.5.8 · CVE-2025-15599 · GHSA-v8jm-5vwx-cfxm · amended
- Medium, CVSS 5.1
DOMPurify contains a Cross-site Scripting vulnerability
npm dompurify · Upgrade to 3.3.2 or 2.5.9 by release line · >= 3.1.3, <= 3.3.1; >= 2.5.3, <= 2.5.8 · CVE-2026-0540 · GHSA-v2wj-7wpq-c8vv · amended
- Low, CVSS 2.4
OpenClaw Vulnerable to HTML injection via unvalidated image MIME type in data-URL interpolation
npm openclaw · Upgrade to 2026.2.23 or later · < 2026.2.23 · CVE-2026-32040 · GHSA-2ww6-868g-2c56 · amended
- Medium, CVSS 6.1
Temporary path handling could write outside OpenClaw temp boundary
npm openclaw · Upgrade to 2026.2.24 or later · <= 2026.2.23 · CVE-2026-32026 · GHSA-33hm-cq8r-wc49 · amended
- Medium, CVSS 4.8
OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container
npm openclaw · Upgrade to 2026.2.21 or later · < 2026.2.21 · CVE-2026-32046 · GHSA-43x4-g22p-3hrq · amended
- High, CVSS 8.7
OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · CVE-2026-32037 · GHSA-w76h-8m22-hpgh · amended
- High, CVSS 8.3
OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading
npm openclaw · Upgrade to 2026.2.14 or later · >= 2.0.0-beta3, <= 2026.2.13 · CVE-2026-28393 · GHSA-7xhj-55q9-pc3m · amended
- High, CVSS 8.6
OpenClaw has command injection via Windows shell fallback in Lobster tool execution
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · CVE-2026-32000 · GHSA-7fcc-cw49-xm78 · amended
- High, CVSS 7.1
OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection
npm openclaw · Upgrade to 2026.2.25 or later · <= 2026.2.24 · GHSA-qj22-xqjr-v83v · amended
- Medium, CVSS 5.3
OpenClaw has allowlist exec-guard bypass via env -S
npm openclaw · Upgrade to 2026.2.23 or later · < 2026.2.23 · CVE-2026-31992 · GHSA-48wf-g7cp-gr3m · amended
- Medium, CVSS 6.1
Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface
PyPI wagtail · Upgrade to 7.3.1, 7.2.3, 7.0.6 or 6.3.8 by release line · < 6.3.8; >= 6.4rc1, < 7.0.6; >= 7.1rc1, < 7.2.3; >= 7.3rc1, < 7.3.1 · CVE-2026-28223 · GHSA-p4v8-rw59-93cq · amended
- Medium, CVSS 6.1
Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes
PyPI wagtail · Upgrade to 7.3.1, 7.2.3, 7.0.6 or 6.3.8 by release line · < 6.3.8; >= 6.4rc1, < 7.0.6; >= 7.1rc1, < 7.2.3; >= 7.3rc1, < 7.3.1 · CVE-2026-28222 · GHSA-p5cm-246w-84jm · amended
- High, CVSS 8.6
BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
PyPI bentoml · Upgrade to 1.4.36 or later · < 1.4.36 · CVE-2026-27905 · GHSA-m6w7-qv66-g3mf · amended
- High, CVSS 8.2
Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack
npm underscore · Upgrade to 1.13.8 or later · <= 1.13.7 · CVE-2026-27601 · GHSA-qpx9-hpmf-5gmw · amended
- Critical, CVSS 9.1
Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection
Packagist froxlor/froxlor · Upgrade to 2.3.4 or later · <= 2.3.3 · CVE-2026-26279 · GHSA-33mp-8p67-xj7c
- Medium, CVSS 5.1
OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
Packagist devcode-it/openstamanager · Upgrade to 2.9.8 or later · < 2.9.8 · CVE-2026-24415 · GHSA-jfgp-g7x7-j25j
- Medium, CVSS 6.8
Rancher Backup Operator pod's logs leak S3 tokens
Go github.com/rancher/backup-restore-operator · Upgrade to 9.0.1, 8.1.2, 7.0.5 or 6.0.3 by release line · >= 9.0.0, < 9.0.1; >= 8.0.0, < 8.1.2; >= 7.0.0, < 7.0.5; >= 6.0.0, < 6.0.3 · CVE-2025-62879 · GHSA-wj3p-5h3x-c74q
- High, CVSS 7.5
Django vulnerable to Uncontrolled Resource Consumption
PyPI django · Upgrade to 6.0.3, 5.2.12 or 4.2.29 by release line · >= 6.0, < 6.0.3; >= 5.2, < 5.2.12; >= 4.2, < 4.2.29 · CVE-2026-25673 · GHSA-8p8v-wh79-9r56 · amended
- Low, CVSS 3.7
Django has a Race Condition vulnerability
PyPI django · Upgrade to 6.0.3, 5.2.12 or 4.2.29 by release line · >= 6.0, < 6.0.3; >= 5.2, < 5.2.12; >= 4.2, < 4.2.29 · CVE-2026-25674 · GHSA-mjgh-79qc-68w3 · amended
- Critical, CVSS 9.9
Rancher cloud credentials can be used through proxy API by users without access
Go github.com/rancher/rancher · Upgrade to 2.5.9 or 2.4.16 by release line · >= 2.2.0, < 2.4.16; >= 2.5.0, < 2.5.9 · CVE-2021-25320 · GHSA-gqf8-rvrh-g7w6
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.