TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
npm @tanstack/start-server-core · Upgrade to 1.169.39 or later · >= 1.143.12, < 1.169.39 · +3 more packages · CVE-2026-102989 · GHSA-qx66-fv34-fjm8 · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
1–25 of 47 matching · newest first
npm @tanstack/start-server-core · Upgrade to 1.169.39 or later · >= 1.143.12, < 1.169.39 · +3 more packages · CVE-2026-102989 · GHSA-qx66-fv34-fjm8 · amended
PyPI pipecat-ai · Upgrade to 1.6.0 or later · >= 0.0.98, <= 1.5.0 · CVE-2026-102682 · GHSA-hqm2-cfx2-2vgh · amended
PyPI jupyterlab · Upgrade to 4.6.4 or 4.5.11 by release line · >= 4.6.0, <= 4.6.3; >= 4.5.7, <= 4.5.10 · +2 more packages · CVE-2026-102832 · GHSA-jwrc-gm9j-263p · amended
npm @anthropic-ai/claude-code · Upgrade to 2.1.179 or later · < 2.1.179 · CVE-2026-86063 · GHSA-pq7j-f95f-qfcv · amended
Go github.com/containerd/containerd · Upgrade to 1.7.35 or later · < 1.7.35 · +1 more package · CVE-2026-95838 · GHSA-rp3h-jf77-q9p4 · amended
npm @builder.io/qwik · Upgrade to 1.20.0 or later · < 1.20.0 · +1 more package · CVE-2026-84994 · GHSA-x586-xvc8-g7q6 · amended
npm @backstage/backend-defaults · Upgrade to 0.17.8 or later · < 0.17.8 · CVE-2026-106495 · GHSA-3xr5-8w6c-p5gw · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.149.0 or later · >= 0.136.0, < 0.149.0 · CVE-2026-100353 · GHSA-vrcc-3ch7-hppw · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.149.0 or later · < 0.149.0 · CVE-2026-100354 · GHSA-g8cf-rcjf-c8cf · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.148.0 or later · < 0.148.0 · CVE-2026-100352 · GHSA-rj39-cv6w-8wv7 · amended
Go github.com/talos-systems/talos +1 · Upgrade all 2 to 1.14.0-alpha.0.0.20260513110206-76080416beee (pre-release) or later · < 1.14.0-alpha.0.0.20260513110206-76080416beee · CVE-2026-77564 · GHSA-7cxh-94cf-mfp6 · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.147.0 or later · >= 0.144.0, < 0.147.0 · CVE-2026-100351 · GHSA-23vg-4cjm-66q5 · amended
npm @appium/support · Upgrade to 7.2.6 or later · <= 7.2.5 · CVE-2026-103975 · GHSA-qfxx-c367-67f8 · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.146.0 or later · >= 0.145.0, < 0.146.0 · CVE-2026-100350 · GHSA-h4r5-mxv5-8mjc · amended
Go github.com/dgraph-io/dgraph/v25 · Upgrade to 25.4.0 or later · <= 25.3.8 · CVE-2026-102748 · GHSA-qj98-gp63-54xj · amended
PyPI tinytag · Upgrade to 2.3.0 or later · >= 2.0.0, < 2.3.0 · CVE-2026-104266 · GHSA-24cc-9352-h2pg · amended
PyPI copyparty · Upgrade to 1.20.19 or later · < 1.20.19 · CVE-2026-104102 · GHSA-phv8-wgjp-g4p9 · amended
Go vitess.io/vitess · Upgrade to 0.24.2 or 0.23.5 by release line · < 0.23.5; >= 0.24.0, < 0.24.2 · CVE-2026-104252 · GHSA-v75v-6fpf-gvw8 · amended
PyPI unstructured · Upgrade to 0.24.1 or later · <= 0.24.0 · CVE-2026-104250 · GHSA-v5mq-3xhg-98m9 · amended
crates.io mise · Upgrade to 2026.7.14 or later · <= 2026.7.13 · CVE-2026-103929 · GHSA-g74g-rg72-j2p3 · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.145.0 or later · < 0.145.0 · CVE-2026-100348 · GHSA-mh7x-f8wq-4jhx · amended
Go github.com/getkin/kin-openapi · Upgrade to 0.145.0 or later · < 0.145.0 · CVE-2026-100347 · GHSA-fh4f-47mf-f2gj · amended
npm nuxt-og-image · Upgrade to 6.7.0 or later · >= 6.2.5, < 6.7.0 · CVE-2026-102527 · GHSA-2x6f-rp82-ppmj · amended
npm @opennextjs/cloudflare · Upgrade to 1.20.2 or later · >= 0.3.0, < 1.20.2 · CVE-2026-100409 · GHSA-2vc4-c4r6-p6v6 · amended
Go github.com/nezhahq/nezha · Upgrade to 0.0.0-20260721131105-c893aa57867d (pre-release) or later · >= 0.0.0-20260628010923-fd31e5f1b0f8, < 0.0.0-20260721131105-c893aa57867d · CVE-2026-100394 · GHSA-qjpp-gffx-2wm9 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.