High, CVSS 8.4
LangChain pickle deserialization of untrusted data
PyPI langchain · Upgrade to 0.2.9 or later · < 0.2.9 · +1 more package · CVE-2024-5998 · GHSA-f2jm-rw3h-6phg · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.3
DOMPurify allows tampering by prototype pollution
npm dompurify · Upgrade to 3.1.3 or 2.5.4 by release line · < 2.5.4; >= 3.0.0, < 3.1.3 · CVE-2024-45801 · GHSA-mmhx-hmjr-r674 · amended
- Critical, CVSS 9.2
Apache Seata Deserialization of Untrusted Data vulnerability
Maven org.apache.seata:seata-core · Upgrade to 2.1.0 or 1.8.1 by release line · >= 1.0.0, < 1.8.1; >= 2.0.0, <= 2.0.0 · CVE-2024-22399 · GHSA-3xq2-w6j4-c99r
- High, CVSS 7.1
Ansible vulnerable to Insertion of Sensitive Information into Log File
PyPI ansible-core · Upgrade to 2.17.6 or 2.16.13 by release line · >= 2.17.0b1, < 2.17.6; < 2.16.13 · CVE-2024-8775 · GHSA-jpxc-vmjf-9fcj · amended
- High, CVSS 8.7
LiteLLM Server-Side Request Forgery (SSRF) vulnerability
PyPI litellm · Upgrade to 1.44.8 or later · < 1.44.8 · CVE-2024-6587 · GHSA-g26j-5385-hhw3 · amended
- High, CVSS 7.5
Path traversal vulnerability in functional web frameworks
Maven org.springframework:spring-webmvc +1 · Upgrade all 2 to 6.1.13; some affected versions have no fix yet · >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39 · CVE-2024-38816 · GHSA-cx7f-g6mp-7hqm
- High, CVSS 8.7
MindsDB Eval Injection vulnerability
PyPI mindsdb · Upgrade to 24.7.4.1 or later · >= 23.10.5.0, < 24.7.4.1 · CVE-2024-45851 · GHSA-wf9g-c67g-h4ch · amended
- High, CVSS 8.7
MindsDB Eval Injection vulnerability
PyPI mindsdb · Upgrade to 24.7.4.1 or later · >= 23.10.3.0, < 24.7.4.1 · CVE-2024-45846 · GHSA-wcjw-3v6p-4v3r · amended
- High, CVSS 8.7
MindsDB Eval Injection vulnerability
PyPI mindsdb · Upgrade to 24.7.4.1 or later · >= 23.11.4.2, < 24.7.4.1 · CVE-2024-45847 · GHSA-crmg-rp64-5cm3 · amended
- High, CVSS 8.7
MindsDB Eval Injection vulnerability
PyPI mindsdb · Upgrade to 24.7.4.1 or later · >= 23.10.5.0, < 24.7.4.1 · CVE-2024-45849 · GHSA-c85f-pcx6-2ghm · amended
- High, CVSS 8.7
MindsDB Eval Injection vulnerability
PyPI mindsdb · Upgrade to 24.7.4.1 or later · >= 23.10.5.0, < 24.7.4.1 · CVE-2024-45850 · GHSA-v6g6-3cm3-vf6c · amended
- High, CVSS 8.7
MindsDB Eval Injection vulnerability
PyPI mindsdb · Upgrade to 24.7.4.1 or later · >= 23.12.4.0, < 24.7.4.1 · CVE-2024-45848 · GHSA-9gq6-6936-885w · amended
- Critical, CVSS 9.9
omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
RubyGems omniauth-saml · Upgrade to 2.2.1, 2.1.2 or 1.10.5 by release line · >= 2.0.0, < 2.1.2; < 1.10.5; >= 2.2.0, < 2.2.1 · GHSA-cvp8-5r8g-fhvq
- High, CVSS 8.7
Untrusted Query Object Evaluation in RPC API
crates.io surrealdb · Upgrade to 2.0.0-beta.3 (pre-release) or 1.5.5 by release line · < 1.5.5; >= 2.0.0-beta.1, < 2.0.0-beta.3 · +1 more package · GHSA-64f8-pjgr-9wmr
- High, CVSS 8.8
dset Prototype Pollution vulnerability
npm dset · Upgrade to 3.1.4 or later · < 3.1.4 · CVE-2024-21529 · GHSA-f6v4-cf5j-vf3w · amended
- High, CVSS 8.3
Session is cached for OpenID and OAuth2 if
redirectis not usednpm directus · Upgrade to 11.1.0 or 10.13.3 by release line · < 10.13.3; >= 11.0.0-rc.1, < 11.1.0 · +1 more package · CVE-2024-45596 · GHSA-cff8-x7jv-4fm8 · amended
- Critical, CVSS 9.9
SAML authentication bypass via Incorrect XPath selector
RubyGems ruby-saml · Upgrade to 1.17.0 or 1.12.3 by release line · < 1.12.3; >= 1.13.0, < 1.17.0 · CVE-2024-45409 · GHSA-jw9c-mfg7-9rx2
- High, CVSS 7.1
Keycloak Denial of Service vulnerability
Maven org.keycloak:keycloak-core · Upgrade to 24.0.0 or later · < 24.0.0 · CVE-2023-6841 · GHSA-w97f-w3hq-36g2
- High, CVSS 8.7
body-parser vulnerable to denial of service when url encoding is enabled
npm body-parser · Upgrade to 1.20.3 or later · < 1.20.3 · CVE-2024-45590 · GHSA-qwcr-r2fm-qrc7 · amended
- High, CVSS 8.3
External Secrets Operator vulnerable to privilege escalation
Go github.com/external-secrets/external-secrets · Upgrade to 0.10.2 or later · < 0.10.2 · CVE-2024-45041 · GHSA-qwgc-rr35-h4x9
- High, CVSS 8.7
Apache Airflow vulnerable to Improper Encoding or Escaping of Output
PyPI apache-airflow · Upgrade to 2.10.1 or later · >= 2.10.0, <= 2.10.0 · CVE-2024-45498 · GHSA-c392-whpc-vfpr · amended
- High, CVSS 8.7
Apache Airflow vulnerable to Execution with Unnecessary Privileges
PyPI apache-airflow · Upgrade to 2.10.1 or later · < 2.10.1 · CVE-2024-45034 · GHSA-92xg-gmrq-5c3w · amended
- High, CVSS 7.7
XXE vulnerability in XSLT transforms in
org.hl7.fhir.coreMaven ca.uhn.hapi.fhir:org.hl7.fhir.dstu2016may +5 · Upgrade all 6 to 6.3.23 or later · < 6.3.23 · CVE-2024-45294 · GHSA-6cr6-ph3p-f5rf
- High, CVSS 8.2
gnark commitments to private witnesses in Groth16 as implemented break zero-knowledge property
Go github.com/consensys/gnark · Upgrade to 0.11.0 or later · < 0.11.0 · CVE-2024-45040 · GHSA-9xcg-3q8v-7fq6
- High, CVSS 7.8
MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
PyPI mindsdb · Upgrade to 23.12.4.2 or later · < 23.12.4.2 · CVE-2024-24759 · GHSA-4jcv-vp96-94xr · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.