Digest · Friday

Security digest: July 24, 2026

17 critical advisories.

Take stock

npm: 9 critical advisories (shescape, @prompty/core, sm-crypto, @better-auth/scim, @budibase/server, seroval, velocityjs). Check with npm audit (or: npm ls <package>).
Maven: 4 critical advisories (org.openidentityplatform.openam:openam-core, org.openidentityplatform.opendj:opendj-server-legacy, org.openidentityplatform.openam:openam-auth-webauthn, org.openidentityplatform.opendj:opendj-dsml-servlet). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
NuGet: 2 critical advisories (Microsoft.OpenApi.Kiota, Microsoft.OpenApi.Kiota.Builder). Check with dotnet list package --vulnerable --include-transitive.
Go: 1 critical advisory (github.com/getkin/kin-openapi). Check with govulncheck ./....
Composer (PHP): 1 critical advisory (pheditor/pheditor). Check with composer audit.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 17

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 9

Check: npm audit (or: npm ls <package>)

Shescape: Shell injection via unescaped parentheses on Windows with CMD CVE-2026-73414 CVSS 9.2 Critical
shescape < 2.1.14 → fixed in 2.1.14; shescape >= 3.0.0, < 3.0.1 → fixed in 3.0.1
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer GHSA-w28w-gp39-m4p6 CVSS 10.0 Critical
@prompty/core <= 0.1.4 → fixed in 0.1.5; @prompty/core >= 2.0.0-alpha.1, <= 2.0.0-beta.4 → fixed in 2.0.0-beta.5
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock CVE-2026-73567 CVSS 9.1 Critical
sm-crypto < 0.5.0 → fixed in 0.5.0
@better-auth/scim: account takeover and stale access via SCIM provider-id collision GHSA-rjg6-39jm-rgg4 CVSS 9.9 Critical
@better-auth/scim >= 1.4.0-beta.27, <= 1.6.21 → fixed in 1.6.22; @better-auth/scim >= 1.7.0-beta.0, <= 1.7.0-beta.9 → fixed in 1.7.0-beta.10
Budibase: SQL Injection via `multipleStatements: true` CVE-2026-73300 CVSS 9.6 Critical
@budibase/server <= 3.38.1 → no fix listed
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization CVE-2026-59940 CVSS 9.8 Critical
seroval <= 1.5.2 → fixed in 1.5.3
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak GHSA-mqhr-6j6h-74p5
@budibase/server <= 3.38.1 → no fix listed
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified CVE-2026-73302 CVSS 9.0 Critical
@budibase/server <= 3.38.1 → no fix listed
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) CVE-2026-73649 CVSS 9.8 Critical
velocityjs <= 2.1.6 → fixed in 2.1.7

Maven 4

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback CVE-2026-62379 CVSS 9.8 Critical
org.openidentityplatform.openam:openam-core <= 16.1.1 → fixed in 16.1.2
OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check CVE-2026-73644 CVSS 9.6 Critical
org.openidentityplatform.opendj:opendj-server-legacy <= 5.1.1 → fixed in 5.1.2
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass CVE-2026-62263 CVSS 9.2 Critical
org.openidentityplatform.openam:openam-auth-webauthn <= 16.1.1 → fixed in 16.1.2
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway GHSA-68r5-9hpg-7qw9 CVSS 9.4 Critical
org.openidentityplatform.opendj:opendj-dsml-servlet <= 5.1.1 → fixed in 5.1.2

NuGet 2

Check: dotnet list package --vulnerable --include-transitive

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info` CVE-2026-59865 CVSS 9.3 Critical
Microsoft.OpenApi.Kiota >= 1.30.0, < 1.32.5 → fixed in 1.32.5; Microsoft.OpenApi.Kiota.Builder >= 1.30.0, < 1.32.5 → fixed in 1.32.5; Microsoft.OpenApi.Kiota < 1.29.1 → fixed in 1.29.1; +1 more packages
Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions CVE-2026-59864 CVSS 9.3 Critical
Microsoft.OpenApi.Kiota >= 1.30.0, < 1.32.5 → fixed in 1.32.5; Microsoft.OpenApi.Kiota.Builder >= 1.30.0, < 1.32.5 → fixed in 1.32.5; Microsoft.OpenApi.Kiota < 1.29.1 → fixed in 1.29.1; +1 more packages

Composer (PHP) 1

Check: composer audit

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password GHSA-f25v-x6vr-962g CVSS 10.0 Critical
pheditor/pheditor < 2.0.8 → fixed in 2.0.8

Go 1

Check: govulncheck ./...

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default GHSA-r277-6w6q-xmqw CVSS 9.1 Critical
github.com/getkin/kin-openapi <= 0.143.0 → fixed in 0.144.0