High, CVSS 8.7
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
PyPI gitpython · Upgrade to 3.1.54 or later · <= 3.1.53 · CVE-2026-73625 · GHSA-r9mr-m37c-5fr3 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 944 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 65 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
3376–3400 of 30,921 matching · newest first
- High, CVSS 7.5
GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
PyPI gitpython · Upgrade to 3.1.54 or later · <= 3.1.53 · CVE-2026-73623 · GHSA-6p8h-3wgx-97gf · amended
- High, CVSS 7.2
GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
PyPI gitpython · Upgrade to 3.1.54 or later · <= 3.1.53 · CVE-2026-73624 · GHSA-fjr4-x663-mwxc · amended
- High, CVSS 7.5
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
npm tar · Upgrade to 7.5.21 or later · <= 7.5.20 · CVE-2026-73566 · GHSA-r292-9mhp-454m · amended
- High, CVSS 7.5
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
npm postcss · Upgrade to 8.5.18 or later · <= 8.5.17 · CVE-2026-73646 · GHSA-r28c-9q8g-f849 · amended
- Critical, CVSS 10.0
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
npm @prompty/core · Upgrade to 2.0.0-beta.5 (pre-release) or 0.1.5 by release line · <= 0.1.4; >= 2.0.0-alpha.1, <= 2.0.0-beta.4 · CVE-2026-73299 · GHSA-w28w-gp39-m4p6 · amended
- Medium, CVSS 6.5
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
npm mongoose · Upgrade to 9.7.2, 8.24.1, 7.8.10 or 6.13.10 by release line · < 6.13.10; >= 7.0.0, < 7.8.10; >= 8.0.0, < 8.24.1; >= 9.0.0, < 9.7.2 · CVE-2026-73562 · GHSA-664h-wqgq-64gw · amended
- High, CVSS 7.0
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
PyPI gitpython · Upgrade to 3.1.53 or later · <= 3.1.52 · CVE-2026-69097 · GHSA-3rp5-jjmw-4wv2 · amended
- Critical, CVSS 9.8
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
npm velocityjs · Upgrade to 2.1.7 or later · <= 2.1.6 · CVE-2026-73649 · GHSA-7gfh-x38p-prh3 · amended
- Medium, CVSS 4.7
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via
redirect_uriallowlist bypassnpm @backstage/plugin-auth-backend · Upgrade to 0.29.2 or later · <= 0.29.1 · CVE-2026-73563 · GHSA-38hq-7x33-php4 · amended
- Medium, CVSS 5.1
ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds
NuGet magick.net-q8-x86 +5 · Upgrade all 6 to 14.15.0 or later · < 14.15.0 · CVE-2026-62946 · GHSA-h22j-f9xw-xjjm
- Medium, CVSS 5.0
ImageMagick: Heap Buffer Over-Write in fx operation
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-62363 · GHSA-422r-8c97-xcg4
- Medium, CVSS 4.7
ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided
NuGet magick.net-q8-arm64 +16 · Upgrade all 17 to 14.15.0 or later · < 14.15.0 · CVE-2026-62343 · GHSA-f5m7-cqgw-8hm7
- Medium, CVSS 5.3
PyMdown Extensions: Path traversal in the b64 extension lets read files outside base_path
PyPI pymdown-extensions · Upgrade to 11.0.0 or later · <= 10.21.3 · CVE-2026-61632 · GHSA-9xwg-3r6f-jcx2 · amended
- Medium, CVSS 4.6
Trix: Stored XSS via HTMLParser attribute injection on paste
npm trix +1 · Upgrade all 2 to 2.1.18 or later · < 2.1.18 · CVE-2026-73428 · GHSA-53g2-mvcc-q9x3 · amended
- Medium, CVSS 6.1
Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
NuGet microsoft.openapi.kiota · Upgrade to 1.34.0 or 1.29.1 by release line · >= 1.30.0, < 1.34.0; < 1.29.1 · CVE-2026-73851 · GHSA-p5rm-jg5c-8c77
- Medium, CVSS 6.9
Valibot: record() issue paths can make flatten() throw for inherited Object property names
npm valibot · Upgrade to 1.4.2 or later · <= 1.4.1 · CVE-2026-59952 · GHSA-5qjj-4xww-7phc · amended
- Critical, CVSS 9.8
seroval:
seroval.fromJSON()Promise resolver type confusion invokes attacker-controlled methods during deserializationnpm seroval · Upgrade to 1.5.3 or later · <= 1.5.2 · CVE-2026-59940 · GHSA-mv8w-475r-vwqw · amended
- High, CVSS 7.0
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59866 · GHSA-4vv7-jj25-4gh6
- Critical, CVSS 9.3
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by
kiota infoNuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59865 · GHSA-hq9q-27g5-qwpj
- High, CVSS 7.0
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59863 · GHSA-4rj6-vrwv-wr8m
- High, CVSS 7.1
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59867 · GHSA-rg4h-fpcp-2qm8
- Critical, CVSS 9.3
Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59864 · GHSA-4jwf-m4wg-8p66
- Medium, CVSS 4.3
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
npm @sveltejs/kit · Upgrade to 2.69.1 or later · <= 2.69.0 · CVE-2026-82257 · GHSA-866w-xmhq-wj7x · amended
- Medium, CVSS 5.3
SvelteKit: Big remote form function payloads can cause Node process to crash
npm @sveltejs/kit · Upgrade to 2.69.1 or later · <= 2.69.0 · CVE-2026-82256 · GHSA-wqjv-9729-c5q2 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.