High, CVSS 8.8
Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
npm claude-code-templates · Upgrade to 1.29.4 or later · <= 1.29.2 · CVE-2026-73222 · GHSA-79wm-x847-7cvg
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
Go github.com/semaphoreui/semaphore · Upgrade to 0.0.0-20260705182501-bb2a4e1f08c8 (pre-release) or later · < 0.0.0-20260705182501-bb2a4e1f08c8 · CVE-2026-73293 · GHSA-cxvf-gvfq-36w2 · amended
- High, CVSS 7.6
Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
Go github.com/semaphoreui/semaphore · Upgrade to 0.0.0-20260707190631-c59c3dc9035b (pre-release) or later · < 0.0.0-20260707190631-c59c3dc9035b · CVE-2026-73292 · GHSA-8cj9-r88m-8945 · amended
- Critical, CVSS 9.3
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-62681 · GHSA-fg9p-mrxr-hvq7 · amended
- Critical, CVSS 9.3
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-62682 · GHSA-88f2-fpv8-89q2 · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via schema default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-72717 · GHSA-w727-8j6c-2rj4 · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via array-items default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71869 · GHSA-2h9g-j24r-h63g · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71871 · GHSA-8j6p-r8jg-mxqh · amended
- Critical, CVSS 9.3
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71867 · GHSA-2w86-xfrc-g85r · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71868 · GHSA-3575-w9fc-c2j6 · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71865 · GHSA-653q-5476-x79g · amended
- Critical, CVSS 9.3
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
npm orval · Upgrade to 8.21.0 or later · < 8.21.0 · CVE-2026-71864 · GHSA-6437-gxhq-pqv8 · amended
- High, CVSS 8.7
LiquidJS has an infinite loop vulnerability in its
strip_htmlfilternpm liquidjs · Upgrade to 10.27.1 or later · >= 10.26.0, < 10.27.1 · CVE-2026-61556 · GHSA-m7fp-h3p4-hr49
- High, CVSS 8.1
OpenClaw Feishu tools could ignore per-account disablement
npm @openclaw/feishu · Upgrade to 2026.6.9 or later · < 2026.6.9 · CVE-2026-62187 · GHSA-2q7j-2vhx-56g8
- Critical, CVSS 9.3
unstructured: Server-Side Request Forgery in the URL-based partitioning
PyPI unstructured · Upgrade to 0.24.0 or later · >= 0.4.7, < 0.24.0 · CVE-2026-71428 · GHSA-4mvj-m6j5-pmf7 · amended
- High, CVSS 8.7
SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass
Go github.com/siyuan-note/siyuan/kernel · Upgrade to 0.0.0-20260714095344-f08dee71ba8e (pre-release) or later · < 0.0.0-20260714095344-f08dee71ba8e · CVE-2026-66394 · GHSA-99rq-75j6-5j9f · amended
- High, CVSS 8.8
OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods
Go github.com/openchoreo/openchoreo · Upgrade to 1.2.0-rc.2 (pre-release), 1.1.4 or 1.0.4 by release line · < 1.0.4; >= 1.1.0, < 1.1.4; >= 1.2.0-rc.1, < 1.2.0-rc.2 · CVE-2026-73667 · GHSA-2mw5-23gm-pccq · amended
- High, CVSS 8.8
OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpoints
Go github.com/openchoreo/openchoreo · Upgrade to 1.2.3 or 1.1.6 by release line · >= 1.2.0-m.1, < 1.2.3; < 1.1.6 · CVE-2026-73841 · GHSA-52gf-6rpq-fgmx · amended
- Critical, CVSS 9.6
OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs
Go github.com/openchoreo/openchoreo · Upgrade to 1.1.2 or 1.0.2 by release line · < 1.0.2; >= 1.1.0, < 1.1.2 · CVE-2026-73843 · GHSA-qh9r-j7rp-4x2m · amended
- High, CVSS 7.5
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
Go github.com/axllent/mailpit · Upgrade to 1.30.4 or later · <= 1.30.3 · CVE-2026-67445 · GHSA-w878-pj84-3j5v · amended
- High, CVSS 8.1
SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths
Go github.com/seaweedfs/seaweedfs · Upgrade to 0.0.0-20260512171048-05ed5c9ae8a2 (pre-release) or later · < 0.0.0-20260512171048-05ed5c9ae8a2 · CVE-2026-72921 · GHSA-gv5w-hfx8-8cwq · amended
- High, CVSS 7.5
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
Go github.com/axllent/mailpit · Upgrade to 1.30.4 or later · <= 1.30.3 · CVE-2026-67446 · GHSA-75mr-qw9x-3r39 · amended
- High, CVSS 7.1
Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py
PyPI omnigent · Upgrade to 0.3.0 or later · < 0.3.0 · CVE-2026-62676 · GHSA-7mqg-cx4g-x2rf
- High, CVSS 8.2
Plate: SSRF with response disclosure in DOCX image embedding
npm @platejs/docx-io · Upgrade to 53.3.2 or later · < 53.3.2 · CVE-2026-65842 · GHSA-4q39-2jhr-7qx8
- High, CVSS 7.5
Handlebars.java: Arbitrary file read in
SpringTemplateLoadervia URL-fragment suffix bypassMaven com.github.jknack:handlebars-springmvc · Upgrade to 4.5.3 or later · < 4.5.3 · CVE-2026-63490 · GHSA-g29j-rwfv-h99w · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.