High, CVSS 8.6
Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine
PyPI ethyca-fides · Upgrade to 2.44.0 or later · >= 2.19.0, < 2.44.0 · CVE-2024-45053 · GHSA-c34r-238x-f7qx · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.7
Missing connection timeout in Aardvark-dns
crates.io aardvark-dns · Upgrade to 1.12.2 or later · >= 1.12.0, < 1.12.2 · CVE-2024-8418 · GHSA-g5jh-57wm-p79m
- High, CVSS 8.7
Hoverfly allows an arbitrary file read in the
/api/v2/simulationendpoint (GHSL-2023-274)Go github.com/spectolabs/hoverfly · Upgrade to 1.10.3 or later · < 1.10.3 · CVE-2024-45388 · GHSA-6xx4-x46f-f897
- High, CVSS 8.6
@actions/download-artifact has an Arbitrary File Write via artifact extraction
GitHub Actions actions/download-artifact · Upgrade to 4.1.3 or later · >= 4.0.0, < 4.1.3 · GHSA-cxww-7g56-2vh6
- High, CVSS 8.7
Denial of service in quinn-proto when using
Endpoint::retry()crates.io quinn-proto · Upgrade to 0.11.7 or later · >= 0.11.0, < 0.11.7 · CVE-2024-45311 · GHSA-vr26-jcq5-fjj8
- High, CVSS 8.6
@actions/artifact has an Arbitrary File Write via artifact extraction
npm @actions/artifact · Upgrade to 2.1.2 or later · >= 2.0.0, < 2.1.2 · CVE-2024-42471 · GHSA-6q32-hq47-5qq3 · amended
- High, CVSS 8.7
Pimcore includes vulnerable PHPOffice/PhpSpreadsheet
Packagist pimcore/pimcore · Upgrade to 11.1.6.11 or 10.6.9.12 by release line · >= 10.6.9.0, < 10.6.9.12; >= 11.1.0.0, < 11.1.6.11 · +2 more packages · GHSA-hq76-662x-7mw4
- High, CVSS 8.7
Tina search token leak via lock file in TinaCMS
npm @tinacms/cli · Upgrade to 1.6.2 or later · < 1.6.2 · CVE-2024-45391 · GHSA-4qrm-9h4r-v2fx · amended
- High, CVSS 8.6
opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
PyPI opencv-python · Upgrade to 4.8.1.78 or later · < 4.8.1.78 · GHSA-qr4w-53vh-m672 · amended
- High, CVSS 8.6
opencv-contrib-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
PyPI opencv-contrib-python · Upgrade to 4.8.1.78 or later · < 4.8.1.78 · GHSA-cxjf-x6jp-p7mc · amended
- High, CVSS 8.6
opencv-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
PyPI opencv-python-headless · Upgrade to 4.8.1.78 or later · < 4.8.1.78 · GHSA-jh2j-j4j9-crg3 · amended
- High, CVSS 8.6
opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
PyPI opencv-contrib-python-headless · Upgrade to 4.8.1.78 or later · < 4.8.1.78 · GHSA-w2pj-9cgh-mq2c · amended
- High, CVSS 7.1
GeoServer style upload functionality vulnerable to XML External Entity (XXE) injection
PyPI geonode · Upgrade to 4.0.3 or later · < 4.0.3 · CVE-2023-26043 · GHSA-mcmc-c59m-pqq8 · amended
- High, CVSS 7.1
nanopb vulnerable to invalid free() call with oneofs and PB_ENABLE_MALLOC
PyPI nanopb · Upgrade to 0.4.5 or 0.3.9.8 by release line · >= 0.3.2, < 0.3.9.8; >= 0.4.0, < 0.4.5 · CVE-2021-21401 · GHSA-7mv5-5mxh-qg88 · amended
- High, CVSS 8.7
Hyperledger Indy's update process of a DID does not check who signs the request
PyPI indy-node · Upgrade to 1.12.4 or later · < 1.12.4 · CVE-2020-11093 · GHSA-wh2w-39f4-rpv2 · amended
- High, CVSS 8.8
HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
PyPI jupyterlab · Upgrade to 4.2.5 or 3.6.8 by release line · <= 3.6.7; >= 4.0.0, <= 4.2.4 · +1 more package · CVE-2024-43805 · GHSA-9q39-rmj3-p4r2 · amended
- High, CVSS 8.8
Kirby has insufficient permission checks in the language settings
Packagist getkirby/cms · Upgrade to 4.3.1, 3.10.1.1, 3.9.8.2 or 3 more by release line · <= 3.6.6.5; >= 3.7.0, <= 3.7.5.4; >= 3.8.0, <= 3.8.4.3; >= 3.9.0, <= 3.9.8.1; >= 3.10.0, <= 3.10.1; >= 4.0.0, <= 4.3.0 · CVE-2024-41964 · GHSA-jm9m-rqr3-wfmh
- High, CVSS 8.7
Ollama can extract members of a ZIP archive outside of the parent directory
Go github.com/ollama/ollama · Upgrade to 0.1.47 or later · < 0.1.47 · CVE-2024-45436 · GHSA-846m-99qv-67mg
- High, CVSS 7.7
Chisel's AUTH environment variable not respected in server entrypoint
Go github.com/jpillora/chisel · Upgrade to 1.10.0 or later · < 1.10.0 · CVE-2024-43798 · GHSA-38jh-8h67-m7mj
- High, CVSS 8.7
Apollo Router Coprocessors may cause Denial-of-Service when handling request bodies
crates.io apollo-router · Upgrade to 1.52.1 or later · >= 1.7.0, < 1.52.1 · CVE-2024-43783 · GHSA-x6xq-whh3-gg32
- High, CVSS 8.7
Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
npm @apollo/gateway · Upgrade to 2.8.5 or later · >= 2.0.0, < 2.8.5 · +2 more packages · CVE-2024-43414 · GHSA-fmj9-77q8-g6c4 · amended
- High, CVSS 8.7
unzip-stream allows Arbitrary File Write via artifact extraction
npm unzip-stream · Upgrade to 0.3.2 or later · < 0.3.2 · GHSA-6jrj-vc65-c983 · amended
- High, CVSS 8.4
Froxlor: /etc/pure-ftpd/db/mysql.conf is chmod 644 but contains
Packagist froxlor/froxlor · Upgrade to 2.2.0 or later · <= 2.2.0-rc3 · GHSA-34qg-65m4-f23m
- High, CVSS 8.9
Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts
crates.io diesel · Upgrade to 2.2.3 or later · < 2.2.3 · GHSA-wq9x-qwcq-mmgf
- High, CVSS 7.2
pretix Stored Cross-site Scripting vulnerability
PyPI pretix · Upgrade to 2024.7.1 or later · < 2024.7.1 · CVE-2024-8113 · GHSA-45rp-q25w-4426 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.