High, CVSS 7.8
Astro's server source code is exposed to the public if sourcemaps are enabled
npm astro · Upgrade to 5.0.8 or 4.16.18 by release line · <= 4.16.17; >= 5.0.0-alpha.0, < 5.0.8 · CVE-2024-56159 · GHSA-49w6-73cw-chjr · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
Non-linear parsing of case-insensitive content in golang.org/x/net/html
Go golang.org/x/net/html · Upgrade to 0.33.0 or later · < 0.33.0 · CVE-2024-45338 · GHSA-w32m-9786-jp63
- Critical, CVSS 9.3Exploited · CISA KEV
Craft CMS has potential RCE when PHP
register_argc_argvconfig setting is enabledPackagist craftcms/cms · Upgrade to 5.5.2, 4.13.2 or 3.9.14 by release line · >= 5.0.0-RC1, < 5.5.2; >= 4.0.0-RC1, < 4.13.2; >= 3.0.0, < 3.9.14 · CVE-2024-56145 · GHSA-2p6p-9rc9-62j9
- High, CVSS 8.9
TShock Security Escalation Exploit
NuGet tshock · Upgrade to 5.2.1 or later · >= 4.3.21, < 5.2.1 · GHSA-hvm9-wc8j-mgrc
- High, CVSS 8.9
UniSharp Laravel Filemanager Code Injection vulnerability
Packagist unisharp/laravel-filemanager · Upgrade to 2.9.1 or later · < 2.9.1 · CVE-2024-21546 · GHSA-6569-3785-r3v6
- High, CVSS 7.7
Spatie Browsershot Directory Traversal vulnerability
Packagist spatie/browsershot · Upgrade to 5.0.2 or later · < 5.0.2 · CVE-2024-21547 · GHSA-v528-6rq9-h6gw
- High, CVSS 7.5
Open Cluster Management vulnerable to Trust Boundary Violation
Go open-cluster-management.io/ocm · Upgrade to 0.13.0 or later · < 0.13.0 · CVE-2024-9779 · GHSA-jhh6-6fhp-q2xp
- High, CVSS 7.3
Databricks JDBC Driver Command Injection vulnerability
Maven com.databricks:databricks-jdbc · Upgrade to 2.6.40 or later · >= 2.0, < 2.6.40 · CVE-2024-49194 · GHSA-jxw2-jvxf-5vrp
- High, CVSS 7.2
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Maven org.apache.tomcat:tomcat-catalina +1 · Upgrade all 2 to 11.0.2, 10.1.34 or 9.0.98 by release line; some affected versions have no fix yet · >= 11.0.0-M1, < 11.0.2; >= 10.1.0-M1, < 10.1.34; >= 9.0.0.M1, < 9.0.98; >= 8.5.0, <= 8.5.100 · CVE-2024-50379 · GHSA-5j33-cvvr-w245
- High, CVSS 7.5
Next.js authorization bypass vulnerability
npm next · Upgrade to 14.2.15 or later · >= 9.5.5, < 14.2.15 · CVE-2024-51479 · GHSA-7gfc-8cq8-jh5f · amended
- High, CVSS 8.7
ASA-2024-0012, ASA-2024-0013: CosmosSDK: Transaction decoding may result in a stack overflow or resource exhaustion
Go github.com/cosmos/cosmos-sdk · Upgrade to 0.50.11 or 0.47.15 by release line · >= 0.50.0-alpha.0, < 0.50.11; < 0.47.15 · +1 more package · GHSA-8wcc-m6j2-qxvm
- High, CVSS 7.1
MinIO vulnerable to privilege escalation in IAM import API
Go github.com/minio/minio · Upgrade to 0.0.0-20241213221912-68b004a48f41 (pre-release) or later · >= 0.0.0-20220623162515-580d9db85e04, < 0.0.0-20241213221912-68b004a48f41 · CVE-2024-55949 · GHSA-cwq8-g58r-32hg
- High, CVSS 8.6
Ucum-java has an XXE vulnerability in XML parsing
Maven org.fhir:ucum · Upgrade to 1.0.9 or later · < 1.0.9 · CVE-2024-55887 · GHSA-w9j7-phm3-f97j
- High, CVSS 8.7
Laravel Pulse Allows Remote Code Execution via Unprotected Query Method
Packagist laravel/pulse · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2024-55661 · GHSA-8vwh-pr89-4mw2
- High, CVSS 7.1
djoser Authentication Bypass
PyPI djoser · Upgrade to 2.3.0 or later · < 2.3.0 · CVE-2024-21543 · GHSA-v49p-m6gh-747c · amended
- Critical, CVSS 9.9
XWiki allows remote code execution through the extension sheet
Maven org.xwiki.platform:xwiki-platform-repository-server-ui · Upgrade to 16.3.0 or 15.10.9 by release line · >= 3.3-milestone-1, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0 · CVE-2024-55662 · GHSA-j2pq-22jj-4pm5
- High, CVSS 8.6
XWiki Platform has an SQL injection in getdocuments.vm with sort parameter
Maven org.xwiki.platform:xwiki-platform-distribution-war · Upgrade to 14.3-rc-1 (pre-release) or 13.10.5 by release line · >= 14.0-rc-1, < 14.3-rc-1; >= 6.3-milestone-2, < 13.10.5 · CVE-2024-55663 · GHSA-wh34-m772-5398
- Critical, CVSS 9.8
http4k has a potential XXE (XML External Entity Injection) vulnerability
Maven org.http4k:http4k-format-xml · Upgrade to 6.50.0.0 or later · < 6.50.0.0 · CVE-2024-55875 · GHSA-7mj5-hjjj-8rgw
- Critical, CVSS 9.9
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
Maven org.xwiki.platform:xwiki-platform-help-ui · Upgrade to 16.5.0, 16.4.1 or 15.10.11 by release line · >= 9.7-rc-1, < 15.10.11; >= 16.0.0-rc-1, < 16.4.1; >= 16.5.0-rc-1, < 16.5.0 · CVE-2024-55877 · GHSA-2r87-74cx-2p7c
- Critical, CVSS 9.1
XWiki allows RCE from script right in configurable sections
Maven org.xwiki.platform:xwiki-platform-administration-ui · Upgrade to 16.3.0 or 15.10.9 by release line · >= 2.3, < 15.10.9; >= 16.0.0-rc-1, < 16.3.0 · CVE-2024-55879 · GHSA-r279-47wg-chpr
- High, CVSS 7.1
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
PyPI apache-superset · Upgrade to 4.1.0 or later · < 4.1.0 · CVE-2024-55633 · GHSA-787v-v9vq-4rgv · amended
- High, CVSS 7.4
io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling
Maven io.quarkus.http:quarkus-http-core · Upgrade to 5.3.4 or later · < 5.3.4 · CVE-2024-12397 · GHSA-cxrx-q234-m22m
- High, CVSS 8.1
PYSEC-2024-297
PyPI pycti · Upgrade to 6.2.18 or later · < 6.2.18 · CVE-2024-45404 · GHSA-hg56-r6hh-56j7
- Critical, CVSS 9.1
Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto
Go golang.org/x/crypto · Upgrade to 0.31.0 or later · < 0.31.0 · CVE-2024-45337 · GHSA-v778-237x-gjrc
- Critical, CVSS 9.5
Apache Struts file upload logic is flawed
Maven org.apache.struts:struts2-core · Upgrade to 6.4.0 or later · < 6.4.0 · CVE-2024-53677 · GHSA-43mq-6xmg-29vm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.