High, CVSS 8.7
njwt Prototype Pollution vulnerability
npm njwt · Upgrade to 2.0.1 or later · < 2.0.1 · CVE-2024-34273 · GHSA-3hvj-2783-34x2 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.9
LoLLMS Command Injection vulnerability
PyPI lollms · Upgrade to 9.5.0 or later · < 9.5.0 · CVE-2024-4078 · GHSA-pwc9-q4hj-pg8g · amended
- High, CVSS 8.8
RunGptLLM class in LlamaIndex has a command injection
PyPI llama-index · Upgrade to 0.10.13 or later · < 0.10.13 · +1 more package · CVE-2024-4181 · GHSA-pw38-xv9x-h8ch · amended
- High, CVSS 7.5
MLflow has a Local File Read/Path Traversal bypass
PyPI mlflow · Upgrade to 2.12.1 or later · >= 2.9.2, < 2.12.1 · CVE-2024-3848 · GHSA-rfqq-wq6w-72jm · amended
- Critical, CVSS 9.9
Laravel RCE vulnerability in "cookie" session driver
Packagist laravel/framework · Upgrade to 7.22.4 or 6.18.31 by release line · >= 4.1.0, < 6.18.31; >= 7.0.0, < 7.22.4 · GHSA-qm5c-m76r-2hfr
- High, CVSS 7.8
Drupal core Arbitrary PHP code execution
Packagist drupal/drupal · Upgrade to 9.0.9, 8.9.10, 8.8.12 or 7.75 by release line · >= 7.0.0, < 7.75; >= 8.0.0, < 8.8.12; >= 8.9.0, < 8.9.10; >= 9.0.0, < 9.0.9 · GHSA-j66p-fvp2-fxhj
- High, CVSS 8.1
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
Packagist drupal/drupal · Upgrade to 8.8.1, 8.7.11 or 7.69 by release line · >= 7.0.0, < 7.69; >= 8.0.0, < 8.7.11; >= 8.8.0, < 8.8.1 · GHSA-m9fv-whq2-6wmc
- High, CVSS 7.8
Drupal core Arbitrary PHP code execution
Packagist drupal/core · Upgrade to 9.0.9, 8.9.10, 8.8.12 or 7.75 by release line · >= 7.0.0, < 7.75; >= 8.0.0, < 8.8.12; >= 8.9.0, < 8.9.10; >= 9.0.0, < 9.0.9 · GHSA-gxxj-g9v8-w28p
- High, CVSS 8.1
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
Packagist drupal/core · Upgrade to 8.8.1, 8.7.11 or 7.69 by release line · >= 7.0.0, < 7.69; >= 8.0.0, < 8.7.11; >= 8.8.0, < 8.8.1 · GHSA-98h9-727m-44qv
- High, CVSS 8.1
Doctrine DBAL SQL injection possibility
Packagist doctrine/dbal · Upgrade to 2.1.2 or 2.0.8 by release line · >= 2.0.0, < 2.0.8; >= 2.1.0, < 2.1.2 · GHSA-76w8-mqx4-wjrf
- Critical, CVSS 9.0
contao/core Insufficient input validation allows for code injection and remote execution
Packagist contao/core · Upgrade to 3.2.9 or 2.11.17 by release line · >= 2.0.0, < 2.11.17; >= 3.0.0, < 3.2.9 · GHSA-wxxw-5gq6-j2g5
- Critical, CVSS 10.0
codeigniter/framework SQL injection in ODBC database driver
Packagist codeigniter/framework · Upgrade to 3.1.0 or later · < 3.1.0 · GHSA-27qr-636m-wxg2
- High, CVSS 8.9
OpenCFP Framework (Sentry) Account takeover via null password reset codes
Packagist cartalyst/sentry · Upgrade to 2.1.7 or later · < 2.1.7 · GHSA-2m5g-8xpw-42vp
- High, CVSS 7.1
easyadmin-extension-bundle action case insensitivity
Packagist alterphp/easyadmin-extension-bundle · Upgrade to 1.3.1 or 1.2.11 by release line · >= 1.3.0, < 1.3.1; >= 1.2.0, < 1.2.11 · GHSA-32rx-xvvr-4xv9
- High, CVSS 8.1
pygmentize Remote Code Execution
Packagist 3f/pygmentize · Upgrade to 1.2 or later · < 1.2 · GHSA-77mv-mp2j-gxxh
- Critical, CVSS 9.6
Mautic is vulnerable to XSS vulnerability
Packagist mautic/core · Upgrade to 3.2.4 or 2.16.5 by release line · < 2.16.5; >= 3.0.0, < 3.2.4 · CVE-2020-35125 · GHSA-42q7-95j7-w62m
- High, CVSS 8.5
Grav Vulnerable to Arbitrary File Read to Account Takeover
Packagist getgrav/grav · Upgrade to 1.7.46 or later · < 1.7.46 · CVE-2024-34082 · GHSA-f8v5-jmfh-pr69
- Critical, CVSS 10.0
Amazon JDBC Driver for Redshift SQL Injection via line comment generation
Maven com.amazon.redshift:redshift-jdbc42 · Upgrade to 2.1.0.28 or later · < 2.1.0.28 · CVE-2024-32888 · GHSA-x3wm-hffr-chwm
- High, CVSS 7.2
Grafana folders admin only permission privilege escalation
Go github.com/grafana/grafana · Upgrade to 9.1.6, 9.0.9 or 8.5.13 by release line · >= 8.5.0, < 8.5.13; >= 9.0.0, < 9.0.9; >= 9.1.0, < 9.1.6 · CVE-2022-36062 · GHSA-p978-56hq-r492
- High, CVSS 8.5
Grafana Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins
Go github.com/grafana/grafana · Upgrade to 9.1.8 or 8.5.14 by release line · >= 5.0.0-beta1, < 8.5.14; >= 9.0.0, < 9.1.8 · CVE-2022-39201 · GHSA-x744-mm8v-vpgr
- High, CVSS 7.2
Grafana Email addresses and usernames can not be trusted
Go github.com/grafana/grafana · Upgrade to 9.2.4 or 8.5.15 by release line · >= 8.0.0, < 8.5.15; >= 9.0.0, < 9.2.4 · CVE-2022-39306 · GHSA-2x6g-h2hg-rq84
- High, CVSS 7.3
Grafana User enumeration via forget password
Go github.com/grafana/grafana · Upgrade to 9.2.4 or 8.5.15 by release line · >= 9.0.0, < 9.2.4; < 8.5.15 · CVE-2022-39307 · GHSA-3p62-42x7-gxg5
- Critical, CVSS 9.3
Grafana Race condition allowing privilege escalation
Go github.com/grafana/grafana · Upgrade to 9.2.4 or later · >= 9.2.0, < 9.2.4 · CVE-2022-39328 · GHSA-vqc4-mpj8-jxch
- High, CVSS 7.5
Grafana Escalation from admin to server admin when auth proxy is used
Go github.com/grafana/grafana · Upgrade to 9.1.6, 9.0.9 or 8.5.13 by release line · >= 9.1.0, < 9.1.6; >= 9.0.0, < 9.0.9; < 8.5.13 · CVE-2022-35957 · GHSA-ff5c-938w-8c9q
- High, CVSS 8.4
Grafana Plugin signature bypass
Go github.com/grafana/grafana · Upgrade to 9.1.8 or 8.5.14 by release line · >= 9.0.0, < 9.1.8; >= 7.0.0, < 8.5.14 · CVE-2022-31123 · GHSA-rhxj-gh46-jvw8
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.