High, CVSS 7.1
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
npm react-router · Upgrade to 8.3.0 or 7.18.2 by release line · >= 7.12.0, < 7.18.2; >= 8.0.0, < 8.3.0 · GHSA-qwww-vcr4-c8h2 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 437 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 533 in the 30 days before.
- Critical
- 68 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
@fastify/static vulnerable to route guard bypass via path traversal
npm @fastify/static · Upgrade to 10.1.1 or later · <= 10.1.0 · CVE-2026-15074 · GHSA-83w8-p2f5-377r · amended
- High, CVSS 8.7
GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution
PyPI gitpython · Upgrade to 3.1.54 or later · <= 3.1.53 · CVE-2026-73625 · GHSA-r9mr-m37c-5fr3 · amended
- High, CVSS 7.5
GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks
PyPI gitpython · Upgrade to 3.1.54 or later · <= 3.1.53 · CVE-2026-73623 · GHSA-6p8h-3wgx-97gf · amended
- High, CVSS 7.2
GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
PyPI gitpython · Upgrade to 3.1.54 or later · <= 3.1.53 · CVE-2026-73624 · GHSA-fjr4-x663-mwxc · amended
- High, CVSS 7.5
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
npm tar · Upgrade to 7.5.21 or later · <= 7.5.20 · CVE-2026-73566 · GHSA-r292-9mhp-454m · amended
- High, CVSS 7.5
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
npm postcss · Upgrade to 8.5.18 or later · <= 8.5.17 · CVE-2026-73646 · GHSA-r28c-9q8g-f849 · amended
- Critical, CVSS 10.0
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
npm @prompty/core · Upgrade to 2.0.0-beta.5 (pre-release) or 0.1.5 by release line · <= 0.1.4; >= 2.0.0-alpha.1, <= 2.0.0-beta.4 · CVE-2026-73299 · GHSA-w28w-gp39-m4p6 · amended
- High, CVSS 7.0
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
PyPI gitpython · Upgrade to 3.1.53 or later · <= 3.1.52 · CVE-2026-69097 · GHSA-3rp5-jjmw-4wv2 · amended
- Critical, CVSS 9.8
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
npm velocityjs · Upgrade to 2.1.7 or later · <= 2.1.6 · CVE-2026-73649 · GHSA-7gfh-x38p-prh3 · amended
- Critical, CVSS 9.8
seroval:
seroval.fromJSON()Promise resolver type confusion invokes attacker-controlled methods during deserializationnpm seroval · Upgrade to 1.5.3 or later · <= 1.5.2 · CVE-2026-59940 · GHSA-mv8w-475r-vwqw · amended
- High, CVSS 7.0
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59866 · GHSA-4vv7-jj25-4gh6
- Critical, CVSS 9.3
Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by
kiota infoNuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59865 · GHSA-hq9q-27g5-qwpj
- High, CVSS 7.0
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59863 · GHSA-4rj6-vrwv-wr8m
- High, CVSS 7.1
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59867 · GHSA-rg4h-fpcp-2qm8
- Critical, CVSS 9.3
Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.5 or 1.29.1 by release line · >= 1.30.0, < 1.32.5; < 1.29.1 · CVE-2026-59864 · GHSA-4jwf-m4wg-8p66
- High, CVSS 8.6
Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)
PyPI ray · Upgrade to 2.56.0 or later · < 2.56.0 · CVE-2026-57516 · GHSA-hhrp-gw25-jr43 · amended
- High, CVSS 8.7
Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.4 or 1.29.1 by release line · >= 1.30.0, < 1.32.4; < 1.29.1 · CVE-2026-59859 · GHSA-jqwh-526h-c92j
- High, CVSS 7.5
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.0 or 1.29.1 by release line · >= 1.30.0, < 1.32.0; < 1.29.1 · CVE-2026-59862 · GHSA-7f3j-j7jj-r3vr
- High, CVSS 7.5
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.0 or 1.29.1 by release line · >= 1.30.0, < 1.32.0; < 1.29.1 · CVE-2026-59861 · GHSA-xg2h-5xr2-29jw
- High, CVSS 8.3
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
npm better-auth · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.22 by release line · >= 1.1.3, < 1.6.22; >= 1.7.0-beta.0, < 1.7.0-beta.10 · CVE-2026-67327 · GHSA-qq9h-g4jm-xgf3 · amended
- High, CVSS 7.1
@better-auth/stripe: cross-organization billing tampering in organization subscription actions
npm @better-auth/stripe · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.21 by release line · >= 1.4.11, < 1.6.21; >= 1.7.0-beta.0, < 1.7.0-beta.10 · CVE-2026-67329 · GHSA-h3rm-78g3-j7cp · amended
- Critical, CVSS 9.9
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
npm @better-auth/scim · Upgrade to 1.7.0-beta.10 (pre-release) or 1.6.22 by release line · >= 1.4.0-beta.27, <= 1.6.21; >= 1.7.0-beta.0, <= 1.7.0-beta.9 · CVE-2026-67330 · GHSA-rjg6-39jm-rgg4 · amended
- High, CVSS 8.7
Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection
NuGet microsoft.openapi.kiota +1 · Upgrade all 2 to 1.32.3 or 1.29.1 by release line · >= 1.30.0, < 1.32.3; < 1.29.1 · CVE-2026-59860 · GHSA-3hrf-2gc2-mx32
- High, CVSS 7.5
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
PyPI httplib2 · Upgrade to 0.32.0 or later · < 0.32.0 · CVE-2026-59939 · GHSA-j5g9-f88f-gfj3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.