High, CVSS 8.8
Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
Maven org.apache.zookeeper:zookeeper · Upgrade to 3.9.3 or later · >= 3.9.0, < 3.9.3 · CVE-2024-51504 · GHSA-g93m-8x6h-g5gv
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.7
Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability
Maven org.apache.tomcat:tomcat-coyote +1 · Upgrade all 2 to 11.0.0-M21 (pre-release), 10.1.25 or 9.0.90 by release line; some affected versions have no fix yet · >= 11.0.0-M1, < 11.0.0-M21; >= 10.1.0-M1, < 10.1.25; >= 9.0.13, < 9.0.90; >= 8.5.35, <= 8.5.100; >= 7.0.92, <= 7.0.109 · CVE-2024-38286 · GHSA-7jqf-v358-p8g7
- Critical, CVSS 9.4
codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service
PyPI codechecker · Upgrade to 6.24.2 or later · <= 6.24.1 · CVE-2024-10082 · GHSA-fpm5-2wcj-vfr7 · amended
- Critical, CVSS 9.9
codechecker vulnerable to authentication bypass when using specifically crafted URLs
PyPI codechecker · Upgrade to 6.24.2 or later · < 6.24.2 · CVE-2024-10081 · GHSA-f3f8-vx3w-hp5q · amended
- High, CVSS 8.3
CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data
Go github.com/cometbft/cometbft · Upgrade to 0.38.15 or later · >= 0.38.0, < 0.38.15 · GHSA-p7mv-53f2-4cwj
- Critical, CVSS 9.3
happy-dom allows for server side code to be executed by a tag
npm happy-dom · Upgrade to 15.10.2 or later · < 15.10.2 · CVE-2024-51757 · GHSA-96g7-g7g9-jxw8 · amended
- High, CVSS 8.6
Symfony vulnerable to command execution hijack on Windows with Process class
Packagist symfony/symfony +1 · Upgrade all 2 to 7.1.7, 6.4.14 or 5.4.46 by release line · < 5.4.46; >= 6.0.0, < 6.4.14; >= 7.0.0, < 7.1.7 · CVE-2024-51736 · GHSA-qq5c-677p-737q
- High, CVSS 8.8
HAPI FHIR XML External Entity (XXE) vulnerability
Maven ca.uhn.hapi.fhir:org.hl7.fhir.convertors +8 · Upgrade all 9 to 6.4.0 or later · < 6.4.0 · CVE-2024-51132 · GHSA-4cf2-cxp3-rjr7
- Critical, CVSS 10.0
CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes
NuGet refit · Upgrade to 7.2.22 or later · < 7.2.22 · CVE-2024-51501 · GHSA-3hxg-fxwm-8gf7
- High, CVSS 8.8
Reposilite vulnerable to path traversal while serving javadoc expanded files (arbitrary file read) (
GHSL-2024-074)Maven com.reposilite:reposilite-backend · Upgrade to 3.5.12 or later · >= 3.3.0, < 3.5.12 · GHSA-82j3-hf72-7x93
- High, CVSS 8.0
Apache Kylin Session Fixation vulnerability
Maven org.apache.kylin:kylin · Upgrade to 5.0.0 or later · >= 2.0.0, < 5.0.0 · CVE-2024-23590 · GHSA-752q-72qc-rc66
- High, CVSS 8.9
Plenti arbitrary file deletion vulnerability
Go github.com/plentico/plenti · Upgrade to 0.7.2 or later · < 0.7.2 · CVE-2024-49381 · GHSA-6h8w-hrfp-pffx
- High, CVSS 8.9
Plenti arbitrary file write vulnerability
Go github.com/plentico/plenti · Upgrade to 0.7.2 or later · < 0.7.2 · CVE-2024-49380 · GHSA-2p96-p7qh-4rgr
- High, CVSS 8.8
Ollama Out-of-bounds Read
Go github.com/ollama/ollama · Upgrade to 0.1.46 or later · < 0.1.46 · CVE-2024-39720 · GHSA-95j2-w8x7-hm88
- High, CVSS 8.7
Hashicorp Vault vulnerable to denial of service through memory exhaustion
Go github.com/hashicorp/vault · Upgrade to 1.18.1 or later · >= 1.2.0, < 1.18.1 · +1 more package · CVE-2024-8185 · GHSA-g233-2p4r-3q7v
- High, CVSS 8.7
Laravel Reverb Missing API Signature Verification
Packagist laravel/reverb · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2024-50347 · GHSA-pfrr-xvrf-pxjx
- High, CVSS 7.8
YesWiki Uses a Broken or Risky Cryptographic Algorithm
Packagist yeswiki/yeswiki · Upgrade to 4.4.5 or later · <= 4.4.4 · CVE-2024-51478 · GHSA-4fvx-h823-38v3
- Critical, CVSS 9.3
DOMPurify vulnerable to tampering by prototype polution
npm dompurify · Upgrade to 2.4.2 or later · < 2.4.2 · CVE-2024-48910 · GHSA-p3vf-v8qc-cwcr · amended
- High, CVSS 8.6
Apache Lucene.Net.Replicator Deserialization of Untrusted Data vulnerability
NuGet lucene.net.replicator · Upgrade to 4.8.0-beta00017 (pre-release) or later · >= 4.8.0-beta00005, < 4.8.0-beta00017 · CVE-2024-43383 · GHSA-2qw8-ppr5-m96c
- High, CVSS 8.7
lilconfig Code Injection vulnerability
npm lilconfig · Upgrade to 3.1.1 or later · >= 3.1.0, < 3.1.1 · CVE-2024-21537 · GHSA-fq9m-v26v-2m4f · amended
- High, CVSS 8.6
Hashicorp Consul Path Traversal vulnerability
Go github.com/hashicorp/consul · Upgrade to 1.20.1 or later · >= 1.9.0, < 1.20.1 · CVE-2024-10005 · GHSA-chgm-7r52-whjj
- Critical, CVSS 9.8
PYSEC-2024-259
PyPI torch · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2024-48063
- Critical, CVSS 9.3
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability
Go github.com/NVIDIA/nvidia-container-toolkit · Upgrade to 1.16.2 or later · < 1.16.2 · CVE-2024-0132 · GHSA-mjjw-553x-87pq
- Critical, CVSS 9.3
Waitress has request processing race condition in HTTP pipelining with invalid first request
PyPI waitress · Upgrade to 3.0.1 or later · >= 2.0.0, < 3.0.1 · CVE-2024-49768 · GHSA-9298-4cf8-g4wj · amended
- High, CVSS 8.7
Kyverno's PolicyException objects can be created in any namespace by default
Go github.com/kyverno/kyverno · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2024-48921 · GHSA-qjvc-p88j-j9rm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.