--- title: "Security digest: July 24, 2026" url: https://erroneo.us/security/2026-07-24/ description: "July 24, 2026 vulnerability digest: 17 critical advisories (Maven, npm, Go, NuGet…). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-07-24 date_modified: 2026-07-24 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: July 24, 2026 17 critical advisories. ## Take stock - npm: 9 critical advisories ( shescape , @prompty/core , sm-crypto , @better-auth/scim , @budibase/server , seroval , velocityjs ). Check with npm audit (or: npm ls ) . - Maven: 4 critical advisories ( org.openidentityplatform.openam:openam-core , org.openidentityplatform.opendj:opendj-server-legacy , org.openidentityplatform.openam:openam-auth-webauthn , org.openidentityplatform.opendj:opendj-dsml-servlet ). Check with mvn dependency:tree -Dincludes=: . - NuGet: 2 critical advisories ( Microsoft.OpenApi.Kiota , Microsoft.OpenApi.Kiota.Builder ). Check with dotnet list package --vulnerable --include-transitive . - Go: 1 critical advisory ( github.com/getkin/kin-openapi ). Check with govulncheck ./... . - Composer (PHP): 1 critical advisory ( pheditor/pheditor ). Check with composer audit . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Known exploited (CISA KEV) None. ## Critical advisories - [CVE-2026-62379](https://erroneo.us/security/cve/CVE-2026-62379/index.md) OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback — Maven org.openidentityplatform.openam:openam-core <= 16.1.1 → 16.1.2 - [CVE-2026-73414](https://erroneo.us/security/cve/CVE-2026-73414/index.md) Shescape: Shell injection via unescaped parentheses on Windows with CMD — npm shescape < 2.1.14 → 2.1.14; npm shescape >= 3.0.0, < 3.0.1 → 3.0.1 - [GHSA-w28w-gp39-m4p6](https://erroneo.us/security/ghsa/GHSA-w28w-gp39-m4p6/index.md) Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer — npm @prompty/core <= 0.1.4 → 0.1.5; npm @prompty/core >= 2.0.0-alpha.1, <= 2.0.0-beta.4 → 2.0.0-beta.5 - [CVE-2026-73567](https://erroneo.us/security/cve/CVE-2026-73567/index.md) sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock — npm sm-crypto < 0.5.0 → 0.5.0 - [GHSA-rjg6-39jm-rgg4](https://erroneo.us/security/ghsa/GHSA-rjg6-39jm-rgg4/index.md) @better-auth/scim: account takeover and stale access via SCIM provider-id collision — npm @better-auth/scim >= 1.4.0-beta.27, <= 1.6.21 → 1.6.22; npm @better-auth/scim >= 1.7.0-beta.0, <= 1.7.0-beta.9 → 1.7.0-beta.10 - [GHSA-r277-6w6q-xmqw](https://erroneo.us/security/ghsa/GHSA-r277-6w6q-xmqw/index.md) kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default — Go github.com/getkin/kin-openapi <= 0.143.0 → 0.144.0 - [CVE-2026-73300](https://erroneo.us/security/cve/CVE-2026-73300/index.md) Budibase: SQL Injection via `multipleStatements: true` — npm @budibase/server <= 3.38.1 → no fix - [CVE-2026-73644](https://erroneo.us/security/cve/CVE-2026-73644/index.md) OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check — Maven org.openidentityplatform.opendj:opendj-server-legacy <= 5.1.1 → 5.1.2 - [CVE-2026-59940](https://erroneo.us/security/cve/CVE-2026-59940/index.md) seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization — npm seroval <= 1.5.2 → 1.5.3 - [GHSA-mqhr-6j6h-74p5](https://erroneo.us/security/ghsa/GHSA-mqhr-6j6h-74p5/index.md) Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak — npm @budibase/server <= 3.38.1 → no fix - [CVE-2026-59865](https://erroneo.us/security/cve/CVE-2026-59865/index.md) Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info` — NuGet Microsoft.OpenApi.Kiota >= 1.30.0, < 1.32.5 → 1.32.5; NuGet Microsoft.OpenApi.Kiota.Builder >= 1.30.0, < 1.32.5 → 1.32.5; NuGet Microsoft.OpenApi.Kiota < 1.29.1 → 1.29.1 - [CVE-2026-73302](https://erroneo.us/security/cve/CVE-2026-73302/index.md) Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified — npm @budibase/server <= 3.38.1 → no fix - [CVE-2026-62263](https://erroneo.us/security/cve/CVE-2026-62263/index.md) OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass — Maven org.openidentityplatform.openam:openam-auth-webauthn <= 16.1.1 → 16.1.2 - [GHSA-f25v-x6vr-962g](https://erroneo.us/security/ghsa/GHSA-f25v-x6vr-962g/index.md) Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password — Composer (PHP) pheditor/pheditor < 2.0.8 → 2.0.8 - [CVE-2026-73649](https://erroneo.us/security/cve/CVE-2026-73649/index.md) Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) — npm velocityjs <= 2.1.6 → 2.1.7 - [GHSA-68r5-9hpg-7qw9](https://erroneo.us/security/ghsa/GHSA-68r5-9hpg-7qw9/index.md) OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway — Maven org.openidentityplatform.opendj:opendj-dsml-servlet <= 5.1.1 → 5.1.2 - [CVE-2026-59864](https://erroneo.us/security/cve/CVE-2026-59864/index.md) Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions — NuGet Microsoft.OpenApi.Kiota >= 1.30.0, < 1.32.5 → 1.32.5; NuGet Microsoft.OpenApi.Kiota.Builder >= 1.30.0, < 1.32.5 → 1.32.5; NuGet Microsoft.OpenApi.Kiota < 1.29.1 → 1.29.1 --- Source page: https://erroneo.us/security/2026-07-24/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt