Critical, CVSS 9.8
Zend-JSON vulnerable to XXE/XEE attacks
Packagist zendframework/zend-json · Upgrade to 2.2.6 or 2.1.6 by release line · >= 2.1.0, < 2.1.6; >= 2.2.0, < 2.2.6 · GHSA-8x2v-pcg7-94f4
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.6
Zendframework Local file disclosure via XXE injection in Zend_XmlRpc
Packagist zendframework/zendframework1 · Upgrade to 1.11.13 or later · >= 1.0.0, < 1.11.13 · GHSA-229x-22xc-2f2w
- High, CVSS 7.5
Zendframework Denial of Service vector via XEE injection
Packagist zendframework/zendframework1 · Upgrade to 1.11.13 or later · >= 1.0.0, < 1.11.13 · GHSA-2jx7-xg83-j2m7
- High, CVSS 8.7
ebookmeta XML External Entity vulnerability
PyPI ebookmeta · Upgrade to 1.2.8 or later · < 1.2.8 · CVE-2024-36827 · GHSA-whf4-fpj8-pgg8 · amended
- High, CVSS 8.8
ebookmeta XML External Entity vulnerability
PyPI ebookmeta · Upgrade to 1.2.8 or later · < 1.2.8 · CVE-2024-37388 · GHSA-hx54-pf28-7xch · amended
- High, CVSS 8.8
Zend-Mail remote code execution in zend-mail via Sendmail adapter
Packagist zendframework/zend-mail · Upgrade to 2.7.2 or 2.4.11 by release line · >= 2.0.0, < 2.4.11; >= 2.5.0, < 2.7.2 · GHSA-cxf7-m5g2-v594
- Critical, CVSS 9.8
ZendFramework potential XML eXternal Entity injection vectors
Packagist zendframework/zendframework1 · Upgrade to 1.12.4 or later · >= 1.12.0, < 1.12.4 · GHSA-mhpx-3rv8-wrjm
- High, CVSS 7.5
ZendFramework potential XML eXternal Entity injection vectors
Packagist zendframework/zendframework1 · Upgrade to 1.12.1 or 1.11.15 by release line · >= 1.11.0, < 1.11.15; >= 1.12.0, < 1.12.1 · GHSA-4j9x-g4x8-vcmf
- Critical, CVSS 9.8
ZendFramework potential SQL Injection Vector When Using PDO_MySql
Packagist zendframework/zendframework1 · Upgrade to 1.11.6 or 1.10.9 by release line · >= 1.10.0, < 1.10.9; >= 1.11.0, < 1.11.6 · GHSA-qf36-fx9f-232x
- Critical, CVSS 9.8
ZendFramework vulnerable to XXE/XEE attacks
Packagist zendframework/zend-xmlrpc · Upgrade to 2.2.6 or 2.1.6 by release line · >= 2.1.0, < 2.1.6; >= 2.2.0, < 2.2.6 · GHSA-f4fj-q6m4-cc52
- High, CVSS 7.5
ZendFramework local file inclusion vector in
Zend_View::setScriptPath()andrender()Packagist zendframework/zendframework1 · Upgrade to 1.7.5 or later · >= 1.7.0, < 1.7.5 · GHSA-hx3m-959f-v849
- High, CVSS 8.8
ZendFramework SQL injection due to execution of platform-specific SQL containing interpolations
Packagist zendframework/zendframework · Upgrade to 2.1.4 or 2.0.8 by release line · >= 2.0.0, < 2.0.8; >= 2.1.0, < 2.1.4 · GHSA-x2f4-8wxf-w3vf
- Critical, CVSS 9.8
Zendframework vulnerable to XXE/XEE attacks
Packagist zendframework/zendframework · Upgrade to 2.2.6 or 2.1.6 by release line · >= 2.1.0, < 2.1.6; >= 2.2.0, < 2.2.6 · GHSA-qc7w-4567-84wv
- High, CVSS 7.4
ZendFramework Potential Information Disclosure and Insufficient Entropy vulnerabilities
Packagist zendframework/zendframework · Upgrade to 2.1.4 or 2.0.8 by release line · >= 2.0.0, < 2.0.8; >= 2.1.0, < 2.1.4 · GHSA-xg9w-r469-m455
- High, CVSS 7.5
ZendFramework Route Parameter Injection Via Query String in
Zend\MvcPackagist zendframework/zendframework · Upgrade to 2.1.4 or 2.0.8 by release line · >= 2.0.0, < 2.0.8; >= 2.1.0, < 2.1.4 · GHSA-jq87-2wxp-8349
- High, CVSS 7.5
Zendframework Remote Address Spoofing Vector in
Zend\Http\PhpEnvironment\RemoteAddressPackagist zendframework/zendframework · Upgrade to 2.2.5 or later · >= 2.2.0, < 2.2.5 · GHSA-xffp-6w68-4775
- High, CVSS 8.1
TYPO3 Security Misconfiguration in Install Tool Cookie
Packagist typo3/cms · Upgrade to 9.5.2, 8.7.21 or 7.6.32 by release line · >= 7.0.0, < 7.6.32; >= 8.0.0, < 8.7.21; >= 9.0.0, < 9.5.2 · GHSA-f777-f784-36gm
- High, CVSS 8.8
TYPO3 Arbitrary Code Execution via File List Module
Packagist typo3/cms · Upgrade to 9.5.4 or 8.7.23 by release line · >= 8.0.0, < 8.7.23; >= 9.0.0, < 9.5.4 · GHSA-8h4m-r4wm-xj7r
- High, CVSS 7.5
TYPO3 Denial of Service in Frontend Record Registration
Packagist typo3/cms · Upgrade to 8.7.21 or 7.6.32 by release line · >= 7.0.0, < 7.6.32; >= 8.0.0, < 8.7.21 · GHSA-g585-crjf-vhwq
- High, CVSS 7.3
TYPO3 Security Misconfiguration for Backend User Accounts
Packagist typo3/cms · Upgrade to 9.5.4 or 8.7.23 by release line · >= 8.0.0, < 8.7.23; >= 9.0.0, < 9.5.4 · GHSA-c5mj-39cf-3pp5
- High, CVSS 8.1
TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling
Packagist typo3/cms · Upgrade to 9.5.12 or 8.7.30 by release line · >= 8.0.0, < 8.7.30; >= 9.0.0, < 9.5.12 · GHSA-hh95-5xm5-v8v7
- High, CVSS 8.8
onnx allows Arbitrary File Overwrite in download_model_with_test_data
PyPI onnx · Upgrade to 1.16.2 or later · < 1.16.2 · CVE-2024-5187 · GHSA-6rq9-53c3-f7vj · amended
- High, CVSS 8.9
LoLLMS Path Traversal vulnerability
PyPI lollms · Upgrade to 9.5.0 or later · < 9.5.0 · CVE-2024-3429 · GHSA-3x47-w4rx-6pm7 · amended
- High, CVSS 7.7
LoLLMS Path Traversal vulnerability
PyPI lollms · Upgrade to 9.5.0 or later · < 9.5.0 · CVE-2024-4881 · GHSA-p8h7-c8gw-6x8c · amended
- High, CVSS 7.0
Arbitrary file deletion in litellm
PyPI litellm · Upgrade to 1.35.36 or later · < 1.35.36 · CVE-2024-4888 · GHSA-3xr8-qfvj-9p9j · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.