High, CVSS 7.3
WiX based installers are vulnerable to binary hijack when run as SYSTEM
NuGet wix · Upgrade to 4.0.5 or 3.14.1 by release line · < 3.14.1; >= 4.0.0, < 4.0.5 · +1 more package · CVE-2024-29187 · GHSA-rf39-3f98-xr7r
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.9
Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
NuGet wix · Upgrade to 4.0.5 or 3.14.1 by release line · < 3.14.1; >= 4.0.0, < 4.0.5 · +1 more package · CVE-2024-29188 · GHSA-jx4p-m4wm-vvjg
- High, CVSS 8.1
WP Crontrol vulnerable to possible RCE when combined with a pre-condition
Packagist johnbillion/wp-crontrol · Upgrade to 1.16.2 or later · < 1.16.2 · CVE-2024-28850 · GHSA-9xvf-cjvf-ff5q
- High, CVSS 7.4
ansys-geometry-core OS Command Injection vulnerability
PyPI ansys-geometry-core · Upgrade to 0.4.12 or 0.3.3 by release line · >= 0.3.0, < 0.3.3; >= 0.4.0, < 0.4.12 · CVE-2024-29189 · GHSA-38jr-29fh-w9vm · amended
- High, CVSS 8.3
OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation
npm @oneuptime/model +1 · Upgrade all 2 to 7.0.1815 or later · < 7.0.1815 · CVE-2024-29194 · GHSA-246p-xmg8-wmcq · amended
- Critical, CVSS 9.3
StringIO buffer overread vulnerability
RubyGems stringio · Upgrade to 3.0.1.1 or later · < 3.0.1.1 · CVE-2024-27280 · GHSA-v5h6-c2hv-hv3r
- High, CVSS 7.3
WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM
NuGet panelswwix4.sdk · Upgrade to 5.0.0-psw-wix.0265-49 (pre-release) or later · <= 5.0.0-psw-wix.0262-48 · GHSA-g4v6-69p6-q3p4
- High, CVSS 7.3
WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM
NuGet panelsw.custom.wix · Upgrade to 3.15.0-a46 (pre-release) or later · <= 3.15.0-a45 · GHSA-wq88-fq4x-h2pm
- Critical, CVSS 9.3
@thi.ng/paths Prototype Pollution vulnerability
npm @thi.ng/paths · Upgrade to 5.1.63 or later · < 5.1.63 · CVE-2024-29650 · GHSA-8ppr-www8-hfjx · amended
- High, CVSS 7.3
SSRF Vulnerability on assetlinks_check(act_name, well_knowns)
PyPI mobsfscan · Upgrade to 0.3.8 or later · < 0.3.8 · +1 more package · CVE-2024-29190 · GHSA-wfgj-wrgh-h3r3 · amended
- High, CVSS 7.5
XNIO denial of service vulnerability
Maven org.jboss.xnio:xnio-api · Upgrade to 3.8.14.Final or later · <= 3.8.13.Final · CVE-2023-5685 · GHSA-7f88-5hhx-67m2
- High, CVSS 8.8
Server Side Template Injection (SSTI) via Twig escape handler
Packagist getgrav/grav · Upgrade to 1.7.45 or later · < 1.7.45 · CVE-2024-28119 · GHSA-2m7x-c7px-hp58
- High, CVSS 8.8
Server Side Template Injection (SSTI)
Packagist getgrav/grav · Upgrade to 1.7.45 or later · < 1.7.45 · CVE-2024-28118 · GHSA-r6vw-8v8r-pmp4
- High, CVSS 8.8
Server Side Template Injection (SSTI)
Packagist getgrav/grav · Upgrade to 1.7.45 or later · < 1.7.45 · CVE-2024-28117 · GHSA-qfv4-q44r-g7rv
- High, CVSS 8.8
Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass
Packagist getgrav/grav · Upgrade to 1.7.45 or later · < 1.7.45 · CVE-2024-28116 · GHSA-c9gp-64c4-2rrh
- High, CVSS 8.8
Grav File Upload Path Traversal
Packagist getgrav/grav · Upgrade to 1.7.45 or later · < 1.7.45 · CVE-2024-27921 · GHSA-m7hx-hw6h-mqmc
- High, CVSS 7.4
Path traversal in webpack-dev-middleware
npm webpack-dev-middleware · Upgrade to 7.1.0, 6.1.2 or 5.3.4 by release line · >= 7.0.0, < 7.1.0; >= 6.0.0, < 6.1.2; <= 5.3.3 · CVE-2024-29180 · GHSA-wr3j-pwj9-hqq6 · amended
- High, CVSS 8.1
ESPHome vulnerable to Authentication bypass via Cross site request forgery
PyPI esphome · Upgrade to 2024.3.0 or later · >= 2023.12.9, < 2024.3.0 · CVE-2024-29019 · GHSA-5925-88xh-6h99 · amended
- High, CVSS 7.5
GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace
PyPI oauthenticator · Upgrade to 16.3.0 or later · < 16.3.0 · CVE-2024-29033 · GHSA-55m3-44xf-hg4h · amended
- Critical, CVSS 9.0
Jupyter Server Proxy's Websocket Proxying does not require authentication
PyPI jupyter-server-proxy · Upgrade to 4.1.1 or 3.2.3 by release line · >= 4.0.0, < 4.1.1; < 3.2.3 · CVE-2024-28179 · GHSA-w3vc-fx9p-wp4v · amended
- High, CVSS 7.2
Arbitrary file upload vulnerability in GeoServer's REST Coverage Store API
Maven org.geoserver:gs-platform +1 · Upgrade all 2 to 2.24.1 or 2.23.4 by release line · < 2.23.4; >= 2.24.0, <= 2.24.0 · CVE-2023-51444 · GHSA-9v5q-2gwq-q9hq
- Critical, CVSS 9.0
Server crashes on invalid Cloud Function or Cloud Job name
npm parse-server · Upgrade to 7.0.0-alpha.29 (pre-release) or 6.5.5 by release line · < 6.5.5; >= 7.0.0-alpha.1, < 7.0.0-alpha.29 · CVE-2024-29027 · GHSA-6hh7-46r2-vf29 · amended
- High, CVSS 8.8
Path traversal in flaskcode Devan-Kerman ARRP
Maven net.devtech:arrp · Upgrade to 0.8.2 or later · <= 0.8.1 · CVE-2024-24042 · GHSA-cg24-jjr5-rxmf
- High, CVSS 7.5
Denial of service via regular expression
PyPI wiki · Upgrade to 0.10.1 or later · < 0.10.1 · CVE-2024-28865 · GHSA-wj85-w4f4-xh8h · amended
- High, CVSS 8.1
Improper HTML sanitization in ZITADEL
Go github.com/zitadel/zitadel · Upgrade to 2.47.4, 2.46.1, 2.45.1 or 6 more by release line · >= 2.42.0, < 2.42.15; >= 2.43.0, < 2.43.9; >= 2.44.0, < 2.44.3; >= 2.45.0, <= 2.45.0; >= 2.46.0, <= 2.46.0; >= 2.47.0, < 2.47.4; < 0.0.0-20240311065202-07ec2efa9dc6; >= 1.80.1, < 2.41.15; < 1.80.0-v2.20.0.20240311065202-07ec2efa9dc6 · CVE-2024-28855 · GHSA-hfrg-4jwr-jfpj
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.