Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.4 or 1.29.1 by release line · >= 1.30.0, < 1.32.4; < 1.29.1 · CVE-2026-59859 · GHSA-jqwh-526h-c92j
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.4 or 1.29.1 by release line · >= 1.30.0, < 1.32.4; < 1.29.1 · CVE-2026-59859 · GHSA-jqwh-526h-c92j
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.0 or 1.29.1 by release line · >= 1.30.0, < 1.32.0; < 1.29.1 · CVE-2026-59862 · GHSA-7f3j-j7jj-r3vr
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.0 or 1.29.1 by release line · >= 1.30.0, < 1.32.0; < 1.29.1 · CVE-2026-59861 · GHSA-xg2h-5xr2-29jw
npm better-auth · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.22 by release line · >= 1.1.3, < 1.6.22; >= 1.7.0-beta.0, < 1.7.0-beta.10 · CVE-2026-67327 · GHSA-qq9h-g4jm-xgf3 · amended
npm @better-auth/stripe · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.21 by release line · >= 1.4.11, < 1.6.21; >= 1.7.0-beta.0, < 1.7.0-beta.10 · CVE-2026-67329 · GHSA-h3rm-78g3-j7cp · amended
npm @better-auth/scim · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.22 by release line · >= 1.4.0-beta.27, <= 1.6.21; >= 1.7.0-beta.0, <= 1.7.0-beta.9 · CVE-2026-67330 · GHSA-rjg6-39jm-rgg4 · amended
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.3 or 1.29.1 by release line · >= 1.30.0, < 1.32.3; < 1.29.1 · CVE-2026-59860 · GHSA-3hrf-2gc2-mx32
PyPI httplib2 · Upgrade to 0.32.0 or later · < 0.32.0 · CVE-2026-59939 · GHSA-j5g9-f88f-gfj3 · amended
crates.io quinn-proto · Upgrade to 0.11.15 or later · >= 0.1.0, < 0.11.15 · GHSA-4w2j-m93h-cj5j
npm react-router · Upgrade to 7.18.0 or later · >= 7.0.0, < 7.18.0 · CVE-2026-55685 · GHSA-chx6-hx7r-mcp5 · amended
pop filter bypasses memoryLimit accounting that its array-filter siblings enforcenpm liquidjs · Upgrade to 10.27.1 or later · <= 10.27.0 · CVE-2026-55575 · GHSA-g357-x5c3-c72p · amended
PRIVATE-TOKEN and mixed-case Authorization credentials in builder-util-runtimenpm builder-util-runtime · Upgrade to 9.7.0 or later · < 9.7.0 · CVE-2026-54673 · GHSA-p2f4-r6v6-j797 · amended
AppImage built by app-builder-libnpm app-builder-lib · Upgrade to 26.15.0 or later · < 26.15.0 · CVE-2026-54672 · GHSA-7g7r-gx96-252g · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.