High, CVSS 8.7
secp256k1-node allows private key extraction over ECDH
npm secp256k1 · Upgrade to 5.0.1, 4.0.4 or 3.8.1 by release line · >= 5.0.0, <= 5.0.0; >= 4.0.0, < 4.0.4; <= 3.8.0 · CVE-2024-48930 · GHSA-584q-6j8j-r5pm · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Denial of service in http-proxy-middleware
npm http-proxy-middleware · Upgrade to 3.0.3 or 2.0.7 by release line · < 2.0.7; >= 3.0.0, < 3.0.3 · CVE-2024-21536 · GHSA-c7qv-q95q-8v27 · amended
- High, CVSS 7.5
Security Update for the OPC UA .NET Standard Stack
NuGet opcfoundation.netstandard.opc.ua +1 · Upgrade all 2 to 1.05.374.54 or later · < 1.05.374.54 · GHSA-qm9f-c3v9-wphv
- High, CVSS 7.1
Permissive Regular Expression in tacquito
Go github.com/facebookincubator/tacquito · Upgrade to 0.0.0-20241011192817-07b49d1358e6 (pre-release) or later · < 0.0.0-20241011192817-07b49d1358e6 · GHSA-p5wf-cmr4-xrwr
- Critical, CVSS 9.4
Grafana Command Injection And Local File Inclusion Via Sql Expressions
Go github.com/grafana/grafana · Upgrade to 11.2.2+security-01, 11.1.7+security-01 or 11.0.6+security-01 by release line · >= 11.0.0, <= 11.0.6; >= 11.1.0, <= 11.1.7; >= 11.2.0, <= 11.2.2 · CVE-2024-9264 · GHSA-q99m-qcv4-fpm7
- High, CVSS 8.1
Insecure Default Initialization of Resource vulnerability in Apache Solr
Maven org.apache.solr:solr · Upgrade to 9.7.0 or 8.11.4 by release line · >= 6.6.0, < 8.11.4; >= 9.0.0, < 9.7.0 · CVE-2024-45217 · GHSA-h7w9-c5vx-x7j3
- Critical, CVSS 9.3
Improper Authentication vulnerability in Apache Solr
Maven org.apache.solr:solr · Upgrade to 9.7.0 or 8.11.4 by release line · >= 5.3.0, < 8.11.4; >= 9.0.0, < 9.7.0 · CVE-2024-45216 · GHSA-mjvf-4h88-6xm3
- High, CVSS 7.7
MySQL Connector/Python connector takeover vulnerability
PyPI mysql-connector-python · Upgrade to 9.1.0 or later · < 9.1.0 · CVE-2024-21272 · GHSA-hgjp-83m4-h4fj · amended
- Critical, CVSS 9.3
VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder
Go github.com/kubernetes-sigs/image-builder · Upgrade to 0.1.38 or later · < 0.1.38 · CVE-2024-9486 · GHSA-9224-ggvw-wh7v
- High, CVSS 8.7
Starlette Denial of service (DoS) via multipart/form-data
PyPI starlette · Upgrade to 0.40.0 or later · < 0.40.0 · CVE-2024-47874 · GHSA-f96h-pmfr-66vw · amended
- High, CVSS 8.7
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
npm matrix-react-sdk · Upgrade to 3.102.0 or later · >= 3.18.0, < 3.102.0 · CVE-2024-47824 · GHSA-qcvh-p9jq-wp8v · amended
- High, CVSS 8.7
Matrix JavaScript SDK's key history sharing could share keys to malicious devices
npm matrix-js-sdk · Upgrade to 34.8.0 or later · >= 9.11.0, < 34.8.0 · CVE-2024-47080 · GHSA-4jf8-g8wp-cx7c · amended
- Critical, CVSS 10.0
changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
PyPI changedetection-io · Upgrade to 0.45.21 or later · < 0.45.21 · CVE-2024-32651 · GHSA-4r7v-whpg-8rx3 · amended
- Critical, CVSS 9.1
Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
npm @vendure/asset-server-plugin · Upgrade to 3.0.5 or 2.3.3 by release line · < 2.3.3; >= 3.0.0, < 3.0.5 · CVE-2024-48914 · GHSA-r9mq-3c9r-fmjq · amended
- High, CVSS 8.7
SAK-50571 Sakai Kernel users created with type roleview can login as a normal user
Maven org.sakaiproject.kernel:sakai-kernel-impl · Upgrade to 23.3 or later · >= 23.0, < 23.3 · CVE-2024-47876 · GHSA-cx95-q6gx-w4qp
- High, CVSS 7.1
Keycloak has session fixation in Elytron SAML adapters
Maven org.keycloak:keycloak-services · Upgrade to 25.0.5, 24.0.7 or 22.0.12 by release line · <= 22.0.11; >= 23.0.0, <= 24.0.6; >= 25.0.0, < 25.0.5 · CVE-2024-7341 · GHSA-5rxp-2rhr-qwqv
- High, CVSS 7.7
Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak
Maven org.keycloak:keycloak-saml-core · Upgrade to 25.0.6, 24.0.8 or 22.0.13 by release line · <= 22.0.12; >= 23.0.0, <= 24.0.7; >= 25.0.0, <= 25.0.5 · CVE-2024-8698 · GHSA-xgfv-xpx8-qhcr
- High, CVSS 7.7
Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
Maven org.apache.activemq:artemis-cli · Upgrade to 2.29.0 or later · < 2.29.0 · CVE-2023-50780 · GHSA-443j-grxv-2pgv
- Critical, CVSS 9.2
pac4j-core affected by a Java deserialization vulnerability
Maven org.pac4j:pac4j-core · Upgrade to 4.0.0 or later · < 4.0.0 · CVE-2023-25581 · GHSA-76mw-6p95-x9x5
- Critical, CVSS 9.3
angular-base64-upload vulnerable to unauthenticated remote code execution
npm angular-base64-upload · Upgrade to 0.1.21 or later · < 0.1.21 · CVE-2024-42640 · GHSA-vgxq-6rcf-qwrw · amended
- High, CVSS 7.9
DOMpurify has a nesting-based mXSS
npm dompurify · Upgrade to 3.1.3 or 2.5.0 by release line · < 2.5.0; >= 3.0.0, < 3.1.3 · CVE-2024-47875 · GHSA-gx9m-whjm-85jf · amended
- Critical, CVSS 9.3
SSOReady has an XML Signature Bypass via differential XML parsing
Go github.com/ssoready/ssoready · Upgrade to 0.0.0-20241009153838-7f92a0630439 (pre-release) or later · < 0.0.0-20241009153838-7f92a0630439 · CVE-2024-47832 · GHSA-j2hr-q93x-gxvh
- High, CVSS 8.6
Snipe-IT remote code execution
Packagist snipe/snipe-it · Upgrade to 7.0.10 or later · < 7.0.10 · CVE-2024-48987 · GHSA-57qh-vmjr-5jxg
- High, CVSS 8.6
Gradio uses insecure communication between the FRP client and server
PyPI gradio · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2024-47871 · GHSA-279j-x4gx-hfrh · amended
- High, CVSS 8.8
Gradio has a race condition in update_root_in_config may redirect user traffic
PyPI gradio · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2024-47870 · GHSA-xh2x-3mrm-fwqm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.