Critical, CVSS 9.9
XWiki programming rights may be inherited by inclusion
Maven org.xwiki.platform:xwiki-platform-rendering-macro-include · Upgrade to 15.0-rc-1 (pre-release) or later · < 15.0-rc-1 · CVE-2024-38369 · GHSA-qcj3-wpgm-qpxh
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.1
Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
Maven org.apache.streampipes:streampipes-resource-management · Upgrade to 0.95.0 or later · >= 0.69.0, < 0.95.0 · CVE-2024-29868 · GHSA-cf3q-vg8w-mw84
- Critical, CVSS 9.8
Remote Code Execution via path traversal bypass in lollms
PyPI lollms · Upgrade to 9.5.1 or later · >= 5.9.0, < 9.5.1 · CVE-2024-5443 · GHSA-mvrm-fh8q-6wr2 · amended
- High, CVSS 7.1
Lightning Network Daemon (LND)'s onion processing logic leads to a denial of service
Go github.com/lightningnetwork/lnd · Upgrade to 0.17.0-beta (pre-release) or later · < 0.17.0-beta · CVE-2024-38359 · GHSA-9gxx-58q6-42p7
- High, CVSS 8.7
Undertow's url-encoded request path information can be broken on ajp-listener
Maven io.undertow:undertow-core · Upgrade to 2.3.14.Final or 2.2.33.Final by release line · >= 2.3.0.Alpha1, < 2.3.14.Final; < 2.2.33.Final · CVE-2024-6162 · GHSA-9442-gm4v-r222
- High, CVSS 8.7
LocalAI path traversal vulnerability
Go github.com/go-skynet/LocalAI · Upgrade to 2.16.0 or later · < 2.16.0 · CVE-2024-5182 · GHSA-cpcx-r2gq-x893
- High, CVSS 8.7
Dolibarr arbitrary file upload vulnerability
Packagist dolibarr/dolibarr · Upgrade to 19.0.2 or later · < 19.0.2 · CVE-2024-37821 · GHSA-p7r8-7w87-8g46
- High, CVSS 7.1
Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpec
Go github.com/rancher/rancher · Upgrade to 2.8.5 or 2.7.14 by release line · >= 2.7.0, < 2.7.14; >= 2.8.0, < 2.8.5 · CVE-2024-22032 · GHSA-q6c7-56cq-g2wm
- High, CVSS 7.5
Rancher's External RoleTemplates can lead to privilege escalation
Go github.com/rancher/rancher · Upgrade to 2.8.5 or 2.7.14 by release line · >= 2.7.0, < 2.7.14; >= 2.8.0, < 2.8.5 · CVE-2023-32196 · GHSA-64jq-m7rq-768h
- Critical, CVSS 9.9
rke's credentials are stored in the RKE1 Cluster state ConfigMap
Go github.com/rancher/rke · Upgrade to 1.5.10 or 1.4.19 by release line · >= 1.4.18, < 1.4.19; >= 1.5.9, < 1.5.10 · CVE-2023-32191 · GHSA-6gr4-52w6-vmqx
- High, CVSS 8.7
Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider
Go github.com/rancher/rancher · Upgrade to 2.8.5 or 2.7.14 by release line · >= 2.7.0, < 2.7.14; >= 2.8.0, < 2.8.5 · CVE-2023-22650 · GHSA-9ghh-mmcq-8phc
- High, CVSS 8.1
LNbits improperly handles potential network and payment failures when using Eclair backend
PyPI lnbits · Upgrade to 0.12.6 or later · < 0.12.6 · CVE-2024-34694 · GHSA-3j4h-h3fp-vwww · amended
- Critical, CVSS 10.0
DeepJavaLibrary API absolute path traversal
Maven ai.djl:api · Upgrade to 0.28.0 or later · >= 0.1.0, < 0.28.0 · CVE-2024-37902 · GHSA-w877-jfw7-46rj
- High, CVSS 8.7
ws affected by a DoS when handling a request with many HTTP headers
npm ws · Upgrade to 8.17.1, 7.5.10, 6.2.3 or 5.2.4 by release line · >= 2.1.0, < 5.2.4; >= 6.0.0, < 6.2.3; >= 7.0.0, < 7.5.10; >= 8.0.0, < 8.17.1 · CVE-2024-37890 · GHSA-3h5v-q93c-6h6q · amended
- High, CVSS 8.3
Object Resolver Prototype Pollution
npm @apphp/object-resolver · Upgrade to 3.1.1 or later · < 3.1.1 · CVE-2024-36577 · GHSA-qj86-v6m7-4qv2 · amended
- Critical, CVSS 9.3
obx Prototype Pollution
npm @almela/obx · Upgrade to 0.0.4 or later · < 0.0.4 · CVE-2024-36573 · GHSA-jj58-488v-4rgf · amended
- High, CVSS 7.8
langchain_experimental Code Execution via Python REPL access
PyPI langchain-experimental · Upgrade to 0.0.61 or later · < 0.0.61 · CVE-2024-38459 · GHSA-wmvm-9vqv-5qpp · amended
- High, CVSS 8.6
Snipe-IT allows users to promote or demote themselves or other users
Packagist snipe/snipe-it · Upgrade to 6.4.2 or later · < 6.4.2 · CVE-2024-5685 · GHSA-544r-fc65-v832
- High, CVSS 7.9
Cilium leaks sensitive information in cilium-bugtool
Go github.com/cilium/cilium · Upgrade to 1.15.6, 1.14.12 or 1.13.17 by release line · >= 1.13.0, < 1.13.17; >= 1.14.0, < 1.14.12; >= 1.15.0, < 1.15.6 · CVE-2024-37307 · GHSA-wh78-7948-358j
- Critical, CVSS 9.8Exploited · CISA KEV
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
Packagist magento/community-edition · Upgrade to 2.4.6-p6 (pre-release), 2.4.5-p8 (pre-release) or 2.4.4-p9 (pre-release) by release line; some affected versions have no fix yet · >= 2.4.4, <= 2.4.4; >= 2.4.6-p1, < 2.4.6-p6; >= 2.4.5-p1, < 2.4.5-p8; < 2.4.4-p9; >= 2.4.5, <= 2.4.5; >= 2.4.6, <= 2.4.6; >= 2.4.7, <= 2.4.7 · CVE-2024-34102 · GHSA-m8cj-3v68-3cxj
- Critical, CVSS 9.2
Magento Open Source Improper Authentication vulnerability
Packagist magento/community-edition · Upgrade to 2.4.6-p6 (pre-release), 2.4.5-p8 (pre-release) or 2.4.4-p9 (pre-release) by release line; some affected versions have no fix yet · >= 2.4.7, <= 2.4.7; >= 2.4.6, <= 2.4.6; >= 2.4.5, <= 2.4.5; >= 2.4.4, <= 2.4.4; >= 2.4.6-p1, < 2.4.6-p6; >= 2.4.5-p1, < 2.4.5-p8; < 2.4.4-p9 · CVE-2024-34103 · GHSA-f7q4-9gwv-6774
- High, CVSS 8.7
Magento Open Source Improper Authorization vulnerability
Packagist magento/community-edition · Upgrade to 2.4.6-p6 (pre-release), 2.4.5-p8 (pre-release) or 2.4.4-p9 (pre-release) by release line; some affected versions have no fix yet · >= 2.4.7, <= 2.4.7; >= 2.4.6, <= 2.4.6; >= 2.4.5, <= 2.4.5; >= 2.4.4, <= 2.4.4; >= 2.4.6-p1, < 2.4.6-p6; >= 2.4.5-p1, < 2.4.5-p8; < 2.4.4-p9 · CVE-2024-34104 · GHSA-wwj3-573j-rvvm
- High, CVSS 7.1
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass
npm @strapi/plugin-users-permissions · Upgrade to 4.24.2 or later · < 4.24.2 · CVE-2024-34065 · GHSA-wrvh-rcmr-9qfc · amended
- High, CVSS 8.1
Globus
identity_providerrestriction ignored when used withallow_allin JupyterHub 5.0PyPI oauthenticator · Upgrade to 16.3.1 or later · < 16.3.1 · CVE-2024-37300 · GHSA-gprj-3p75-f996 · amended
- Critical, CVSS 9.1
parisneo/lollms Local File Inclusion (LFI) attack
PyPI lollms · Upgrade to 9.5.0 or later · < 9.5.0 · CVE-2024-4315 · GHSA-vqwr-q6cc-c242 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.