High, CVSS 8.6
Soundness issue with Plonky2 look up tables
crates.io plonky2 · Upgrade to 1.0.1 or later · >= 1.0.0, <= 1.0.0 · CVE-2025-24802 · GHSA-hj49-h7fq-px5h
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
Deep Java Library path traversal issue
Maven ai.djl:api · Upgrade to 0.31.1 or later · < 0.31.1 · CVE-2025-0851 · GHSA-jcrp-x7w3-ffmg
- High, CVSS 7.0
snowflake-connector-python vulnerable to SQL Injection in write_pandas
PyPI snowflake-connector-python · Upgrade to 3.13.1 or later · >= 2.2.5, <= 3.13.0 · CVE-2025-24793 · GHSA-2vpq-fh52-j3wv · amended
- High, CVSS 7.8
Snowflake JDBC allows an untrusted search path on Windows
Maven net.snowflake:snowflake-jdbc · Upgrade to 3.22.0 or later · >= 3.2.3, <= 3.21.0 · CVE-2025-24789 · GHSA-7hpq-3g6w-pvhf
- High, CVSS 8.1
Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search Document
Packagist pimcore/pimcore · Upgrade to 11.5.3 or later · >= 11.4.2, < 11.5.3 · CVE-2024-11954 · GHSA-xr3m-6gq6-22cg
- High, CVSS 8.2
OpenShift GitOps Operator Namespace Isolation Break
Go github.com/redhat-developer/gitops-operator · Upgrade to 1.16.2 or later · < 1.16.2 · CVE-2024-13484 · GHSA-58fx-7v9q-3g56
- Critical, CVSS 9.3
ismp-grandpa crate accepted incorrect signatures
crates.io ismp-grandpa · Upgrade to 15.0.1 or later · < 15.0.1 · +2 more packages · CVE-2025-24800 · GHSA-wwx5-gpgr-vxr7
- High, CVSS 7.5
vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator
PyPI vllm · Upgrade to 0.7.0 or later · < 0.7.0 · CVE-2025-24357 · GHSA-rh4j-5rhw-hr54 · amended
- High, CVSS 7.2
Apache Solr vulnerable to Execution with Unnecessary Privileges
Maven org.apache.solr:solr-core · Upgrade to 9.8.0 or later · < 9.8.0 · CVE-2025-24814 · GHSA-68r2-fwcg-qpm8
- High, CVSS 8.4
ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape
PyPI asteval · Upgrade to 1.0.6 or later · <= 1.0.5 · CVE-2025-24359 · GHSA-3wwr-3g9f-9gc7 · amended
- High, CVSS 7.1
Updatecli exposes Maven credentials in console output
Go github.com/updatecli/updatecli · Upgrade to 0.93.0 or later · < 0.93.0 · CVE-2025-24355 · GHSA-v34r-vj4r-38j6
- High, CVSS 8.6
XXE vulnerability in XSLT parsing in
org.hl7.fhir.publisherMaven org.hl7.fhir.publisher:org.hl7.fhir.publisher.cli +1 · Upgrade all 2 to 1.7.4 or later · < 1.7.4 · CVE-2024-52807 · GHSA-8c3x-hq82-gjcm
- High, CVSS 8.4
ASTEVAL Allows Malicious Tampering of Exposed AST Nodes Leads to Sandbox Escape
PyPI asteval · Upgrade to 1.0.6 or later · <= 1.0.5 · GHSA-vp47-9734-prjw · amended
- High, CVSS 7.5
Unlimited consumption of resources in @fastify/multipart
npm @fastify/multipart · Upgrade to 9.0.3 or 8.3.1 by release line · <= 8.3.0; >= 9.0.0, < 9.0.3 · CVE-2025-24033 · GHSA-27c6-mcxv-x3fh · amended
- High, CVSS 7.1
Envoy Admin Interface Exposed through prometheus metrics endpoint
Go github.com/envoyproxy/gateway · Upgrade to 1.2.6 or later · < 1.2.6 · CVE-2025-24030 · GHSA-j777-63hf-hx76
- High, CVSS 7.9
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
PyPI restrictedpython · Upgrade to 8.0 or later · >= 6.0, < 8.0 · CVE-2025-22153 · GHSA-gmj9-h825-chq2 · amended
- High, CVSS 8.8
Bitbucket Server Integration Plugin allows bypassing CSRF protection for any URL
Maven io.jenkins.plugins:atlassian-bitbucket-server-integration · Upgrade to 4.1.4 or later · >= 2.1.0, < 4.1.4 · CVE-2025-24398 · GHSA-qjw6-xvrm-5f2h
- High, CVSS 8.8
Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin
Maven org.jenkins-ci.plugins:oic-auth · Upgrade to 4.453.v4d7765c854f4 or later · < 4.453.v4d7765c854f4 · CVE-2025-24399 · GHSA-q9cm-88jx-3vfw
- Critical, CVSS 9.1
Apache Ranger UI vulnerable to Server Side Request Forgery
Maven org.apache.ranger:ranger · Upgrade to 2.5.0 or later · >= 0.5.0, < 2.5.0 · CVE-2024-45479 · GHSA-g9gf-g5jq-9h3v
- High, CVSS 8.6
Buildah allows build breakout using malicious Containerfiles and concurrent builds
Go github.com/containers/buildah · Upgrade to 1.38.1, 1.37.6, 1.35.5 or 1.33.12 by release line · >= 1.38.0, < 1.38.1; >= 1.37.0, < 1.37.6; >= 1.35.0, < 1.35.5; < 1.33.12 · CVE-2024-11218 · GHSA-5vpc-35f4-r8w6
- High, CVSS 7.5
sniff_csv provides filesystem access even when enable_external_access is disabled in duckdb
PyPI duckdb · Upgrade to 1.1.0 or later · >= 1.0.0, < 1.1.0 · CVE-2024-41672 · GHSA-w2gf-jxc9-pf2q · amended
- High, CVSS 8.2
Cross-Site Request Forgery in CodeChecker API
PyPI codechecker · Upgrade to 6.24.5 or later · < 6.24.5 · CVE-2024-53829 · GHSA-f8c8-4pm7-w885 · amended
- High, CVSS 7.1
Authenticated arbitrary file deletion in YesWiki
Packagist yeswiki/yeswiki · Upgrade to 4.5.0 or later · <= 4.4.5 · CVE-2025-24019 · GHSA-43c9-gw4x-pcx6
- High, CVSS 7.6
Authenticated Stored XSS in YesWiki
Packagist yeswiki/yeswiki · Upgrade to 4.5.0 or later · <= 4.4.5 · CVE-2025-24018 · GHSA-w59h-3x3q-3p6j
- High, CVSS 7.6
Unauthenticated DOM Based XSS in YesWiki
Packagist yeswiki/yeswiki · Upgrade to 4.5.0 or later · <= 4.4.5 · CVE-2025-24017 · GHSA-wphc-5f2j-jhvg
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.