Orval: Import-time RCE via header-parameter default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71871 · GHSA-8j6p-r8jg-mxqh · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71871 · GHSA-8j6p-r8jg-mxqh · amended
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71867 · GHSA-2w86-xfrc-g85r · amended
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71868 · GHSA-3575-w9fc-c2j6 · amended
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71865 · GHSA-653q-5476-x79g · amended
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71864 · GHSA-6437-gxhq-pqv8 · amended
strip_html filternpm liquidjs · Upgrade to 10.27.1 or later · >= 10.26.0, < 10.27.1 · CVE-2026-61556 · GHSA-m7fp-h3p4-hr49
npm @openclaw/feishu · Upgrade to 2026.6.9 or later · < 2026.6.9 · CVE-2026-62187 · GHSA-2q7j-2vhx-56g8
PyPI unstructured · Upgrade to 0.24.0 or later · >= 0.4.7, < 0.24.0 · CVE-2026-71428 · GHSA-4mvj-m6j5-pmf7 · amended
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260714095344-f08dee71ba8e (pre-release) or later · < 0.0.0-20260714095344-f08dee71ba8e · CVE-2026-66394 · GHSA-99rq-75j6-5j9f · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.