OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns
npm openclaw · Upgrade to 2026.3.1 or later · < 2026.3.1 · CVE-2026-32048 · GHSA-p7gr-f84w-hqg5 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
9801–9825 of 31,071 matching · newest first
npm openclaw · Upgrade to 2026.3.1 or later · < 2026.3.1 · CVE-2026-32048 · GHSA-p7gr-f84w-hqg5 · amended
npm openclaw · Upgrade to 2026.3.1 or later · < 2026.3.1 · CVE-2026-28461 · GHSA-wr6m-jg37-68xh · amended
npm openclaw · Upgrade to 2026.3.1 or later · < 2026.3.1 · GHSA-392f-ggf5-fp3c · amended
npm openclaw · Upgrade to 2026.3.1 or later · < 2026.3.1 · CVE-2026-32041 · GHSA-vpj2-69hf-rppw · amended
PyPI openchatbi · Upgrade to 0.2.2 or later · <= 0.2.1 · CVE-2026-28795 · GHSA-vmwq-8g8c-jm79 · amended
@orpc/client has Prototype Pollution via StandardRPCJsonSerializer Deserializationnpm @orpc/client · Upgrade to 1.13.6 or later · <= 1.13.5 · CVE-2026-28794 · GHSA-m272-9rp6-32mc · amended
Go github.com/OliveTin/OliveTin · Upgrade to 0.0.0-20260302002902-d9804182eae4 (pre-release) or later · < 0.0.0-20260302002902-d9804182eae4 · CVE-2026-28790 · GHSA-4fqm-6fmh-82mq
Go github.com/OliveTin/OliveTin · Upgrade to 0.0.0-20260301235225-f044d90d5525c (pre-release) or later · < 0.0.0-20260301235225-f044d90d5525c · CVE-2026-28789 · GHSA-45m3-398w-m2m9
npm @builder.io/qwik · Upgrade to 1.19.1 or later · <= 1.19.0 · CVE-2026-27971 · GHSA-p9x5-jp3h-96mm · amended
Packagist idno/known · Upgrade to 1.6.4 or later · < 1.6.4 · CVE-2026-28507 · GHSA-37j7-56xc-c468
Packagist idno/known · Upgrade to 1.6.4 or later · <= 1.6.3 · CVE-2026-28508 · GHSA-fcrh-fqxh-6fx6
PyPI cocoindex · Upgrade to 0.3.34 or later · < 0.3.34 · CVE-2026-28438 · GHSA-59g6-v3vg-f7wc · amended
Go github.com/filebrowser/filebrowser/v2 · Upgrade to 2.61.0 or later · <= 2.60.0 · CVE-2026-28492 · GHSA-mr74-928f-rw69
PyPI products-isurlinportal · Upgrade to 4.0.0, 3.1.0 or 2.1.0 by release line · >= 4.0.0a1, <= 4.0.0a1; >= 3.0.0, < 3.1.0; < 2.1.0; < 2.1.0; >= 3.0.0, < 3.1.0 · CVE-2026-28413 · GHSA-43gx-6gv6-3jcp · amended
npm nocodb · Upgrade to 0.301.3 or later · < 0.301.3 · CVE-2026-28361 · GHSA-p9x3-w98f-7j3q · amended
npm nocodb · Upgrade to 0.301.3 or later · < 0.301.3 · CVE-2026-28396 · GHSA-x4vh-j75g-268g · amended
npm nocodb · Upgrade to 0.301.3 or later · < 0.301.3 · CVE-2026-28360 · GHSA-mpp2-x7wv-38hv · amended
npm nocodb · Upgrade to 0.301.3 or later · <= 0.301.2 · CVE-2026-28359 · GHSA-qxwq-q265-hc44 · amended
npm nocodb · Upgrade to 0.301.3 or later · <= 0.301.2 · CVE-2026-28358 · GHSA-387m-j3p9-3php · amended
npm nocodb · Upgrade to 0.301.3 or later · <= 0.301.2 · CVE-2026-28357 · GHSA-vx5p-q85x-xm3c · amended
PyPI lxml-html-clean · Upgrade to 0.4.4 or later · <= 0.4.3 · CVE-2026-28350 · GHSA-xvp8-3mhv-424c · amended
PyPI lxml-html-clean · Upgrade to 0.4.4 or later · <= 0.4.3 · CVE-2026-28348 · GHSA-hw26-mmpg-fqfg · amended
Go github.com/OliveTin/OliveTin · Upgrade to 0.0.0-20260227002407-2eb5f0ba79d4 (pre-release) or later · < 0.0.0-20260227002407-2eb5f0ba79d4 · CVE-2026-28342 · GHSA-pc8g-78pf-4xrp
Go github.com/chainguard-dev/malcontent · Upgrade to 1.21.0 or later · < 1.21.0 · GHSA-54p8-x2m9-c593
PyPI joserfc · Upgrade to 1.6.3 or later · < 1.6.3 · CVE-2026-27932 · GHSA-w5r5-m38g-f9f9 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.