High, CVSS 7.5
Gradio lacks integrity checking on the downloaded FRP client
PyPI gradio · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2024-47867 · GHSA-8c87-gvhj-xm8m · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.6
Vault Community Edition privilege escalation vulnerability
Go github.com/hashicorp/vault · Upgrade to 1.18.0 or later · < 1.18.0 · +1 more package · CVE-2024-9180 · GHSA-rr8j-7w34-xp5j
- High, CVSS 8.7
Gradios's CORS origin validation is not performed when the request has a cookie
PyPI gradio · Upgrade to 4.44.0 or later · < 4.44.0 · CVE-2024-47084 · GHSA-3c67-5hwx-f6wx · amended
- High, CVSS 8.3
btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality
Go github.com/btcsuite/btcd · Upgrade to 0.24.2-beta.rc1 (pre-release) or later · < 0.24.2-beta.rc1 · CVE-2024-38365 · GHSA-27vh-h6mc-q6g8
- High, CVSS 7.1
Magento Open Source Improper Authorization vulnerability
Packagist magento/community-edition · Upgrade to 2.4.7-p3 (pre-release), 2.4.6-p8 (pre-release), 2.4.5-p10 (pre-release) or 2.4.4-p11 (pre-release) by release line; some affected versions have no fix yet · >= 2.4.7-beta1, < 2.4.7-p3; >= 2.4.6-p1, < 2.4.6-p8; >= 2.4.5-p1, < 2.4.5-p10; < 2.4.4-p11; >= 2.4.7, <= 2.4.7; >= 2.4.6, <= 2.4.6; >= 2.4.5, <= 2.4.5; >= 2.4.4, <= 2.4.4 · CVE-2024-45132 · GHSA-5f64-ppmg-cvvm
- High, CVSS 7.1
Magento Open Source Improper Access Control vulnerability
Packagist magento/community-edition · Upgrade to 2.4.7-p3 (pre-release), 2.4.6-p8 (pre-release), 2.4.5-p10 (pre-release) or 2.4.4-p11 (pre-release) by release line; some affected versions have no fix yet · >= 2.4.7-beta1, < 2.4.7-p3; >= 2.4.6-p1, < 2.4.6-p8; >= 2.4.5-p1, < 2.4.5-p10; < 2.4.4-p11; >= 2.4.7, <= 2.4.7; >= 2.4.6, <= 2.4.6; >= 2.4.5, <= 2.4.5; >= 2.4.4, <= 2.4.4 · CVE-2024-45118 · GHSA-cg52-68fv-94qq
- High, CVSS 7.1
SurrealDB: Improper Authorization in Select Permissions
crates.io surrealdb +1 · Upgrade all 2 to 2.0.4 or later · < 2.0.4 · CVE-2024-58367 · GHSA-9722-9j67-vjcr
- High, CVSS 7.1
SurrealDB has an Uncaught Exception Handling Parsing Errors on Empty Strings
crates.io surrealdb +1 · Upgrade all 2 to 2.0.4 or later · >= 2.0.0, < 2.0.4 · GHSA-qjrv-v6qp-x99x
- High, CVSS 7.7
Livewire Remote Code Execution on File Uploads
Packagist livewire/livewire · Upgrade to 3.5.2 or 2.12.7 by release line · >= 3.0.0-beta.1, < 3.5.2; < 2.12.7 · CVE-2024-47823 · GHSA-f3cx-396f-7jqp
- High, CVSS 7.1
Adguard Home arbitrary file read vulnerability
Go github.com/AdguardTeam/AdGuardHome · Upgrade to 0.107.53 or later · < 0.107.53 · CVE-2024-36814 · GHSA-9cp9-8gw2-8v7m
- High, CVSS 8.8
Microsoft Security Advisory CVE-2024-43485 | .NET Denial of Service Vulnerability
NuGet system.text.json · Upgrade to 8.0.5 or 6.0.10 by release line · >= 8.0.0, <= 8.0.4; >= 6.0.0, <= 6.0.9 · CVE-2024-43485 · GHSA-8g4q-xg66-9fp4
- High, CVSS 8.8
Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability
NuGet system.io.packaging · Upgrade to 9.0.0-rc.2.24473.5 (pre-release), 8.0.1 or 6.0.1 by release line · >= 9.0.0-preview.1.24080.9, <= 9.0.0-rc.1.24431.7; >= 8.0.0-preview.1.23110.8, <= 8.0.0; >= 6.0.0-preview.1.21102.12, <= 6.0.0 · CVE-2024-43484 · GHSA-f32c-w444-8ppv
- High, CVSS 8.8
Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability
NuGet system.io.packaging · Upgrade to 9.0.0-rc.2.24473.5 (pre-release), 8.0.1 or 6.0.1 by release line · >= 9.0.0-preview.1.24080.9, <= 9.0.0-rc.1.24431.7; >= 6.0.0-preview.1.21102.12, <= 6.0.0; >= 8.0.0-preview.1.23110.8, <= 8.0.0 · +2 more packages · CVE-2024-43483 · GHSA-qj66-m88j-hmgj
- High, CVSS 8.4
DeepSpeed Remote Code Execution Vulnerability
PyPI deepspeed · Upgrade to 0.15.1 or later · < 0.15.1 · CVE-2024-43497 · GHSA-8cp5-3rf8-8gfh · amended
- High, CVSS 8.2
Microsoft Security Advisory CVE-2024-38229 | .NET Remote Code Execution Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 +11 · Upgrade all 12 to 9.0.0-rc.2.24474.3 (pre-release) or 8.0.10 by release line · >= 9.0.0-preview.1.24081.5, <= 9.0.0-rc.1.24452.1; >= 8.0.0, <= 8.0.8 · CVE-2024-38229 · GHSA-7vw9-cfwx-9gx9
- High, CVSS 7.1
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability
npm @saltcorn/server · Upgrade to 1.0.0-beta.16 (pre-release) or later · <= 1.0.0-beta.15 · CVE-2024-47818 · GHSA-43f3-h63w-p6f6 · amended
- High, CVSS 8.6
Parse Server's custom object ID allows to acquire role privileges
npm parse-server · Upgrade to 7.3.0 or 6.5.9 by release line · < 6.5.9; >= 7.0.0, < 7.3.0 · CVE-2024-47183 · GHSA-8xq9-g7ch-35hg · amended
- High, CVSS 7.3
@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source
npm @saltcorn/plugins-loader · Upgrade to 1.0.0-beta.14 (pre-release) or later · <= 1.0.0-beta.13 · GHSA-fm76-w8jw-xf8m · amended
- High, CVSS 7.3
@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating
langanddefstringparameters when setting localizer stringsnpm @saltcorn/server · Upgrade to 1.0.0-beta.14 (pre-release) or later · <= 1.0.0-beta.13 · GHSA-78p3-fwcq-62c2 · amended
- High, CVSS 8.7
async-graphql Directive Overload
crates.io async-graphql · Upgrade to 7.0.10 or later · < 7.0.10 · CVE-2024-47614 · GHSA-5gc2-7c65-8fq8
- High, CVSS 8.7
PAM module may allow accessing with the credentials of another user
Go github.com/ubuntu/authd · Upgrade to 0.3.5 or 0.0.0-20240930103526-63e527496b01 (pre-release) by release line · < 0.0.0-20240930103526-63e527496b01; >= 0.1.0, < 0.3.5 · CVE-2024-9313 · GHSA-x5q3-c8rm-w787
- High, CVSS 8.7
Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
Maven commons-io:commons-io · Upgrade to 2.14.0 or later · >= 2.0, < 2.14.0 · CVE-2024-47554 · GHSA-78wr-2p64-hpwj
- Critical, CVSS 9.3
Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)
Maven org.apache.avro:avro · Upgrade to 1.11.4 or later · < 1.11.4 · CVE-2024-47561 · GHSA-r7pg-v2c8-mfg3
- High, CVSS 7.6
Pomerium service account access token may grant unintended access to databroker API
Go github.com/pomerium/pomerium · Upgrade to 0.27.1 or later · < 0.27.1 · CVE-2024-47616 · GHSA-r7rh-jww5-5fjr
- High, CVSS 7.1
OpenC3 Path Traversal via screen controller (
GHSL-2024-127)PyPI openc3 +1 · Upgrade all 2 to 5.19.0 or later · < 5.19.0 · CVE-2024-46977 · GHSA-8jxr-mccc-mwg8 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.