High, CVSS 7.1
LibreNMS uses Improper Sanitization on Service template name leads to Stored XSS
Packagist librenms/librenms · Upgrade to 24.4.0 or later · < 24.4.0 · CVE-2024-32479 · GHSA-72m9-7c8x-pmmw
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
LibreNMS vulnerable to SQL injection time-based leads to database extraction
Packagist librenms/librenms · Upgrade to 24.4.0 or later · < 24.4.0 · CVE-2024-32461 · GHSA-cwx6-cx7x-4q34
- High, CVSS 7.8
Ant Media Server vulnerable to a local privilege escalation
Maven io.antmedia:ant-media-server · Upgrade to 2.9.0 or later · >= 2.6.0, < 2.9.0 · CVE-2024-32656 · GHSA-qwhw-hh9j-54f5
- High, CVSS 8.8
Apache HugeGraph-Server: Bypass whitelist in Auth mode
Maven org.apache.hugegraph:hugegraph-api · Upgrade to 1.3.0 or later · >= 1.0.0, < 1.3.0 · CVE-2024-27349 · GHSA-6mgp-p75r-vhjm
- Critical, CVSS 9.3Exploited · CISA KEV
Apache HugeGraph-Server: Command execution in gremlin
Maven org.apache.hugegraph:hugegraph-core +1 · Upgrade all 2 to 1.3.0 or later · >= 1.0.0, < 1.3.0 · CVE-2024-27348 · GHSA-29rc-vq7f-x335
- High, CVSS 7.8
OpenStack Storlets arbitrary code execution vulnerability
PyPI storlets · Upgrade to 13.0.0.0rc1 (pre-release) or later · < 13.0.0.0rc1 · CVE-2024-28717 · GHSA-rfm2-f94j-qhjp · amended
- High, CVSS 7.5
@hono/node-server has Denial of Service risk when receiving Host header that cannot be parsed
npm @hono/node-server · Upgrade to 1.10.1 or later · >= 1.3.0, < 1.10.1 · CVE-2024-32652 · GHSA-hgxw-5xg3-69jx · amended
- High, CVSS 7.3
Sentry vulnerable to leaking superuser cleartext password in logs
PyPI sentry · Upgrade to 24.4.1 or later · >= 24.3.0, < 24.4.1 · CVE-2024-32474 · GHSA-6cjm-4pxw-7xp9 · amended
- High, CVSS 7.1
Dolibarr Application Home Page has HTML injection vulnerability
Packagist dolibarr/dolibarr · Upgrade to 18.0.7 or later · >= 18.0.4, < 18.0.7 · CVE-2024-23817 · GHSA-7947-48q7-cp5m
- Critical, CVSS 9.8
@andrei-tatar/nora-firebase-common Prototype Pollution vulnerability
npm @andrei-tatar/nora-firebase-common · Upgrade to 1.12.3 or later · >= 1.0.41, < 1.12.3 · CVE-2024-30564 · GHSA-jjff-q3q4-5hh8 · amended
- Critical, CVSS 9.8
HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches
Go github.com/hashicorp/go-getter · Upgrade to 1.7.4 or later · >= 1.5.9, < 1.7.4 · CVE-2024-3817 · GHSA-q64h-39hv-4cf7
- High, CVSS 7.8
Pytorch use-after-free vulnerability
PyPI torch · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2024-31583 · GHSA-pg7h-5qx3-wjr3 · amended
- High, CVSS 8.7
PyTorch heap buffer overflow vulnerability
PyPI torch-npu +1 · Upgrade all 2 to 2.2.0 or later · < 2.2.0 · CVE-2024-31580 · GHSA-5pcm-hx3q-hm94 · amended
- High, CVSS 8.6
Keycloak path traversal vulnerability in redirection validation
Maven org.keycloak:keycloak-services · Upgrade to 24.0.3 or 22.0.10 by release line · < 22.0.10; >= 23.0.0, < 24.0.3 · CVE-2024-1132 · GHSA-72vp-xfrc-42xm
- High, CVSS 7.4
Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS
Maven org.keycloak:keycloak-services · Upgrade to 24.0.3 or 22.0.10 by release line · < 22.0.10; >= 23.0.0, < 24.0.3 · CVE-2024-1249 · GHSA-m6q9-p373-g5q8
- High, CVSS 7.3
.NET Elevation of Privilege Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 8.0.4, 7.0.18 or 6.0.29 by release line · >= 7.0.0, <= 7.0.17; >= 8.0.0, <= 8.0.3; <= 6.0.28 · CVE-2024-21409 · GHSA-6qmx-42h2-j8h6
- Critical, CVSS 9.1
Evmos vulnerable to DOS and transaction fee expropiation through Authz exploit
Go github.com/evmos/evmos/v11 · Upgrade to 12.0.0 or later · < 12.0.0 · GHSA-v6rw-hhgg-wc4x
- High, CVSS 7.1
Keycloak path traversal vulnerability in the redirect validation
Maven org.keycloak:keycloak-services · Upgrade to 24.0.3 or 22.0.10 by release line · < 22.0.10; >= 23.0.0, < 24.0.3 · CVE-2024-2419 · GHSA-mrv8-pqfj-7gp5
- High, CVSS 7.1
Cross-site Scripting (XSS) possible due to improper sanitisation of
hrefattributes onRubyGems phlex · Upgrade to 1.10.1, 1.9.2, 1.8.3 or 4 more by release line · >= 1.10.0, <= 1.10.0; >= 1.9.0, < 1.9.2; >= 1.8.0, < 1.8.3; >= 1.7.0, < 1.7.2; >= 1.6.0, < 1.6.3; >= 1.5.0, < 1.5.3; < 1.4.2 · CVE-2024-32463 · GHSA-g7xq-xv8c-h98c
- High, CVSS 8.1
OpenFGA Authorization Bypass
Go github.com/openfga/openfga · Upgrade to 1.5.3 or later · >= 1.5.0, < 1.5.3 · CVE-2024-31452 · GHSA-8cph-m685-6v6r
- Critical, CVSS 9.3
Keras code injection vulnerability
PyPI keras · Upgrade to 2.13.1rc0 (pre-release) or later · < 2.13.1rc0 · CVE-2024-3660 · GHSA-x4wf-678h-2pmq · amended
- High, CVSS 8.1
Spring Framework URL Parsing with Host Validation
Maven org.springframework:spring-web · Upgrade to 6.1.6, 6.0.19 or 5.3.34 by release line · < 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6 · CVE-2024-22262 · GHSA-2wrp-6fg6-hmc5
- Critical, CVSS 9.8
llama-index-core Command Injection vulnerability
PyPI llama-index-core · Upgrade to 0.10.24 or later · < 0.10.24 · CVE-2024-3271 · GHSA-r6gp-rff2-p3hf · amended
- Critical, CVSS 9.3
mlflow vulnerable to Path Traversal
PyPI mlflow · Upgrade to 2.10.0 or later · < 2.10.0 · CVE-2024-3573 · GHSA-hq88-wg7q-gp4g · amended
- Critical, CVSS 9.8
Insecure deserialization in BentoML
PyPI bentoml · Upgrade to 1.2.5 or later · < 1.2.5 · CVE-2024-2912 · GHSA-hvj5-mvw9-93j3 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.