Security advisories

high2026-07-24

CVE-2026-55607-Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

anthropics/claude-code · GHSA-7835-87q9-rgvv

high2026-07-24

CVE-2026-73507-Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

netty/netty · GHSA-v74w-7mr3-4qg3

medium2026-07-24

CVE-2026-73508-Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

netty/netty · GHSA-mfg7-5gfp-c4w3

critical2026-07-24

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

getkin/kin-openapi · GHSA-r277-6w6q-xmqw

medium2026-07-24

cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

cel-expr/cel-go · GHSA-gcjh-h69q-9w9g

high2026-07-24

CVE-2026-73643-js-yaml: Exponential parsing time in flow collections leads to denial of service

nodeca/js-yaml · GHSA-pm4m-ph32-ghv5

medium2026-07-24

CVE-2026-73429-Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

eugeny/russh · GHSA-g9hv-x236-4qp3

medium2026-07-24

CVE-2026-73489-Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

eugeny/russh · GHSA-cqjc-rmpq-xprq

medium2026-07-24

CVE-2026-73430-Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

eugeny/russh · GHSA-5xvq-cp9x-6p6r

high2026-07-24

React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response

remix-run/react-router · GHSA-qwww-vcr4-c8h2

low2026-07-24

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

aws/aws-cdk · GHSA-464c-974j-9xm6

medium2026-07-24

CVE-2026-7120-@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

fastify/fastify-static · GHSA-8pvw-jcv7-9cmj

high2026-07-24

CVE-2026-15074-@fastify/static vulnerable to route guard bypass via path traversal

fastify/fastify-static · GHSA-83w8-p2f5-377r

high2026-07-24

GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution

gitpython-developers/gitpython · GHSA-r9mr-m37c-5fr3

high2026-07-24

GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks

gitpython-developers/gitpython · GHSA-6p8h-3wgx-97gf

high2026-07-24

GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)

gitpython-developers/gitpython · GHSA-fjr4-x663-mwxc

high2026-07-24

CVE-2026-73566-node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection

isaacs/node-tar · GHSA-r292-9mhp-454m

high2026-07-24

CVE-2026-73646-PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

postcss/postcss · GHSA-r28c-9q8g-f849

critical2026-07-24

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

microsoft/prompty · GHSA-w28w-gp39-m4p6

medium2026-07-24

CVE-2026-73562-Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

automattic/mongoose · GHSA-664h-wqgq-64gw