Medium, CVSS 4.6
Trix: Stored XSS via HTMLParser attribute injection on paste
npm trix +1 · Upgrade all 2 to 2.1.18 or later · < 2.1.18 · CVE-2026-73428 · GHSA-53g2-mvcc-q9x3 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 982 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,020 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
76–100 of 129 matching · newest first
- Medium, CVSS 6.1
Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
NuGet microsoft.openapi.kiota · Upgrade to 1.34.0 or 1.29.1 by release line · >= 1.30.0, < 1.34.0; < 1.29.1 · CVE-2026-73851 · GHSA-p5rm-jg5c-8c77
- Medium, CVSS 6.9
Valibot: record() issue paths can make flatten() throw for inherited Object property names
npm valibot · Upgrade to 1.4.2 or later · <= 1.4.1 · CVE-2026-59952 · GHSA-5qjj-4xww-7phc · amended
- Critical, CVSS 9.8
seroval:
seroval.fromJSON()Promise resolver type confusion invokes attacker-controlled methods during deserializationnpm seroval · Upgrade to 1.5.3 or later · <= 1.5.2 · CVE-2026-59940 · GHSA-mv8w-475r-vwqw · amended
- High, CVSS 7.0
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59866 · GHSA-4vv7-jj25-4gh6
- Critical, CVSS 9.3
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by
kiota infoNuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59865 · GHSA-hq9q-27g5-qwpj
- High, CVSS 7.0
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59863 · GHSA-4rj6-vrwv-wr8m
- High, CVSS 7.1
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59867 · GHSA-rg4h-fpcp-2qm8
- Critical, CVSS 9.3
Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59864 · GHSA-4jwf-m4wg-8p66
- Medium, CVSS 4.3
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
npm @sveltejs/kit · Upgrade to 2.69.1 or later · <= 2.69.0 · CVE-2026-82257 · GHSA-866w-xmhq-wj7x · amended
- Medium, CVSS 5.3
SvelteKit: Big remote form function payloads can cause Node process to crash
npm @sveltejs/kit · Upgrade to 2.69.1 or later · <= 2.69.0 · CVE-2026-82256 · GHSA-wqjv-9729-c5q2 · amended
- Medium, CVSS 6.8
AWS CLI: Overly permissive File Permissions
PyPI awscli · Upgrade to 1.44.78 or later · <= 1.44.77 · CVE-2026-13769 · GHSA-wfp6-f47h-hxc3 · amended
- Low, CVSS 3.3
ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape
PyPI onnx · Upgrade to 1.22.0 or later · >= 1.3.0, <= 1.21.0 · CVE-2026-63632 · GHSA-p893-rvq9-2xf9 · amended
- High, CVSS 8.6
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
PyPI ray · Upgrade to 2.56.0 or later · < 2.56.0 · CVE-2026-57516 · GHSA-hhrp-gw25-jr43 · amended
- High, CVSS 8.7
Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.4 or 1.29.1 by release line · >= 1.30.0, < 1.32.4; < 1.29.1 · CVE-2026-59859 · GHSA-jqwh-526h-c92j
- High, CVSS 7.5
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.0 or 1.29.1 by release line · >= 1.30.0, < 1.32.0; < 1.29.1 · CVE-2026-59862 · GHSA-7f3j-j7jj-r3vr
- High, CVSS 7.5
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.0 or 1.29.1 by release line · >= 1.30.0, < 1.32.0; < 1.29.1 · CVE-2026-59861 · GHSA-xg2h-5xr2-29jw
- High, CVSS 8.3
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
npm better-auth · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.22 by release line · >= 1.1.3, < 1.6.22; >= 1.7.0-beta.0, < 1.7.0-beta.10 · CVE-2026-67327 · GHSA-qq9h-g4jm-xgf3 · amended
- High, CVSS 7.1
@better-auth/stripe: cross-organization billing tampering in organization subscription actions
npm @better-auth/stripe · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.21 by release line · >= 1.4.11, < 1.6.21; >= 1.7.0-beta.0, < 1.7.0-beta.10 · CVE-2026-67329 · GHSA-h3rm-78g3-j7cp · amended
- Critical, CVSS 9.9
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
npm @better-auth/scim · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.22 by release line · >= 1.4.0-beta.27, <= 1.6.21; >= 1.7.0-beta.0, <= 1.7.0-beta.9 · CVE-2026-67330 · GHSA-rjg6-39jm-rgg4 · amended
- Medium, CVSS 6.0
BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes
PyPI blender-mcp · Upgrade to 1.6.5 or later · < 1.6.5 · CVE-2026-66004 · GHSA-4h8q-hh2j-755w · amended
- Medium, CVSS 6.9
Hugging Face Datasets folder-based builders allow path traversal through file_name metadata
PyPI datasets · Upgrade to 5.0.1 or later · < 5.0.1 · CVE-2026-66007 · GHSA-379c-qx7v-6h59 · amended
- Low, CVSS 1.8
ImageMagick: Heap Buffer Over-Write in X11 import with crafted window title
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · GHSA-76q6-2p6h-xjqr
- High, CVSS 8.7
Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.3 or 1.29.1 by release line · >= 1.30.0, < 1.32.3; < 1.29.1 · CVE-2026-59860 · GHSA-3hrf-2gc2-mx32
- High, CVSS 7.5
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
PyPI httplib2 · Upgrade to 0.32.0 or later · < 0.32.0 · CVE-2026-59939 · GHSA-j5g9-f88f-gfj3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.