High, CVSS 7.0
Kubean vulnerable to cluster-level privilege escalation
Go github.com/kubean-io/kubean · Upgrade to 0.18.0 or later · < 0.18.0 · CVE-2024-41820 · GHSA-3wfj-3x8q-hrpg
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.7
Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability
npm rocket.chat · Upgrade to 6.10.1 or later · < 6.10.1 · CVE-2024-39713 · GHSA-ffxg-5f8m-h72j · amended
- High, CVSS 8.7
Path traversal in Reposilite javadoc file expansion (arbitrary file creation/overwrite) (
GHSL-2024-073)Maven com.reposilite:reposilite-backend · Upgrade to 3.5.12 or later · >= 3.3.0, < 3.5.12 · CVE-2024-36116 · GHSA-frvj-cfq4-3228
- High, CVSS 7.7
Reposilite artifacts vulnerable to Stored Cross-site Scripting
Maven com.reposilite:reposilite-backend · Upgrade to 3.5.12 or later · >= 3.3.0, < 3.5.12 · CVE-2024-36115 · GHSA-9w8w-34vr-65j2
- High, CVSS 8.6
soft-serve vulnerable to arbitrary code execution by crafting git-lfs requests
Go github.com/charmbracelet/soft-serve · Upgrade to 0.7.5 or later · < 0.7.5 · CVE-2024-41956 · GHSA-m445-w3xr-vp2f
- High, CVSS 7.1
Apache Linkis vulnerable to privilege escalation
Maven org.apache.linkis:linkis · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2024-27181 · GHSA-v352-rg37-5q5m
- High, CVSS 7.0
Apache Linkis arbitrary file deletion vulnerability
Maven org.apache.linkis:linkis · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2024-27182 · GHSA-j6vx-r77h-44wc
- High, CVSS 7.2
Apache Inlong Code Injection vulnerability
Maven org.apache.inlong:tubemq-core · Upgrade to 1.13.0 or later · >= 1.10.0, < 1.13.0 · CVE-2024-36268 · GHSA-qff2-8qw7-hcvw
- High, CVSS 8.7
NetBird uses a static initialization vector (IV)
Go github.com/netbirdio/netbird · Upgrade to 0.29.2 or later · >= 0.23.2, < 0.29.2 · CVE-2024-41260 · GHSA-9v35-4xcr-w9ph
- High, CVSS 7.0
Mattermost allows remote actor to create/update/delete posts in arbitrary channels
Go github.com/mattermost/mattermost · Upgrade to 5.3.2-0.20240619142046-8181a9ddffc0 (pre-release) or later · < 5.3.2-0.20240619142046-8181a9ddffc0 · +1 more package · CVE-2024-41144 · GHSA-vg67-chm7-8m3j
- Critical, CVSS 9.3
Mattermost allows unsolicited invites to expose access to local channels
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 9.9.1, 9.8.1, 9.7.6 or 9.5.7 by release line · >= 9.9.0, < 9.9.1; >= 9.5.0, < 9.5.7; >= 9.7.0, < 9.7.6; >= 9.8.0, < 9.8.1 · CVE-2024-39777 · GHSA-q22q-2rrf-m27p
- Critical, CVSS 9.3
Mattermost failed to properly validate that the channel that comes from the sync message is a shared channel
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 9.9.1, 9.8.2, 9.7.6 or 9.5.7 by release line · >= 9.5.0, < 9.5.7; >= 9.7.0, < 9.7.6; >= 9.8.0, < 9.8.2; >= 9.9.0, <= 9.9.0 · CVE-2024-39274 · GHSA-cmc8-222c-vqp9
- High, CVSS 8.7
Beego privilege escalation vulnerability
Go github.com/beego/beego/v2 · Upgrade to 2.2.1 or later · < 2.2.1 · CVE-2024-40465 · GHSA-wr3p-r5fj-wf97
- High, CVSS 8.7
Beego privilege escalation vulnerability
Go github.com/beego/beego/v2 · Upgrade to 2.2.1 or later · < 2.2.1 · CVE-2024-40464 · GHSA-r6qh-j42j-pw64
- High, CVSS 7.7
Insecure Jinja2 templates rendered in Haystack Components can lead to RCE
PyPI haystack-ai · Upgrade to 2.3.1 or later · < 2.3.1 · CVE-2024-41950 · GHSA-hx9v-6r9f-w677 · amended
- Critical, CVSS 9.4
XWiki Platform vulnerable to Cross-Site Scripting (XSS) through conflict resolution
Maven org.xwiki.platform:xwiki-platform-web-templates · Upgrade to 16.3.0-rc-1 (pre-release) or 15.10.8 by release line · >= 11.8-rc-1, < 15.10.8; >= 16.0.0-rc-1, < 16.3.0-rc-1 · CVE-2024-41947 · GHSA-692v-783f-mg8x
- High, CVSS 7.0
Harbor fails to validate the user permissions when updating project configurations
Go github.com/goharbor/harbor · Upgrade to 2.10.3 or 2.9.5 by release line · < 2.9.5; >= 2.10.0, < 2.10.3 · CVE-2024-22278 · GHSA-hw28-333w-qxp3
- High, CVSS 8.7
Weave server API vulnerable to arbitrary file leak
PyPI weave · Upgrade to 0.50.8 or later · < 0.50.8 · CVE-2024-7340 · GHSA-r49h-6qxq-624f · amended
- Critical, CVSS 9.4
XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
Maven org.xwiki.platform:xwiki-platform-search-ui · Upgrade to 15.10.2, 15.5.5 or 14.10.21 by release line · >= 9.2-rc-1, < 14.10.21; >= 15.0-rc-1, < 15.5.5; >= 15.6-rc-1, < 15.10.2 · CVE-2024-37901 · GHSA-h63h-5c77-77p5
- High, CVSS 8.7
XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader
Maven org.xwiki.platform:xwiki-platform-web-war · Upgrade to 16.0.0, 15.10.6, 15.5.5 or 14.10.21 by release line · >= 4.2-milestone-3, < 14.10.21; >= 15.0-rc-1, < 15.5.5; >= 15.6-rc-1, < 15.10.6; >= 16.0.0-rc-1, < 16.0.0 · CVE-2024-37900 · GHSA-wf3x-jccf-5g5g
- High, CVSS 8.7
@75lb/deep-merge Prototype Pollution vulnerability
npm @75lb/deep-merge · Upgrade to 1.1.2 or later · <= 1.1.1 · CVE-2024-38986 · GHSA-28mc-g557-92m7 · amended
- High, CVSS 8.7
TensorFlow has segfault in array_ops.upper_bound
PyPI tensorflow +2 · Upgrade all 3 to 2.12.1 or later · < 2.12.1 · CVE-2023-33976 · GHSA-gjh7-xx4r-x345 · amended
- Critical, CVSS 9.3
pREST vulnerable to jwt bypass + sql injection
Go github.com/prest/prest · Upgrade to 1.5.4 or later · < 1.5.4 · GHSA-wm25-j4gw-6vr3
- High, CVSS 8.8
Apache SeaTunnel Web Authentication vulnerability
Maven org.apache.seatunnel:seatunnel-web · Upgrade to 1.0.1 or later · < 1.0.1 · CVE-2023-48396 · GHSA-cp2c-x2pc-fph7
- High, CVSS 8.7
GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service
Maven com.graphql-java:graphql-java · Upgrade to 21.5, 20.9 or 19.11 by release line · < 19.11; >= 20.0, < 20.9; >= 21.0, < 21.5 · CVE-2024-40094 · GHSA-h9mq-f6q5-6c8m
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.