High, CVSS 8.8
Remote Code Execution Vulnerability in Microsoft Django Backend for SQL Server
PyPI mssql-django · Upgrade to 1.4.1 or later · < 1.4.1 · CVE-2024-26164 · GHSA-vmqv-47j8-gwv8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
ASA-2024-006: ValidateVoteExtensions helper function in Cosmos SDK may allow incorrect voting power assumptions
Go github.com/cosmos/cosmos-sdk · Upgrade to 0.50.5 or later · >= 0.50.0, <= 0.50.4 · GHSA-95rx-m9m5-m94v
- High, CVSS 8.8
StimulusReflex arbitrary method call
RubyGems stimulus_reflex · Upgrade to 3.5.0.rc4 or 3.4.2 by release line · >= 3.5.0.pre0, < 3.5.0.rc4; < 3.4.2 · +1 more package · CVE-2024-28121 · GHSA-f78j-4w3g-4q65 · amended
- High, CVSS 7.1
Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex
RubyGems phlex · Upgrade to 1.9.1, 1.8.2, 1.7.1 or 7 more by release line · >= 1.9.0, <= 1.9.0; >= 1.8.0, < 1.8.2; >= 1.7.0, <= 1.7.0; >= 1.6.0, < 1.6.2; >= 1.5.0, < 1.5.2; >= 1.4.0, <= 1.4.0; >= 1.3.0, < 1.3.3; >= 1.2.0, < 1.2.2; >= 1.1.0, <= 1.1.0; < 1.0.1 · CVE-2024-28199 · GHSA-242p-4v39-2v8g
- High, CVSS 7.1
Account Takeover via Session Fixation in Zitadel [Bypassing MFA]
Go github.com/zitadel/zitadel · Upgrade to 2.45.1 or 2.44.3 by release line · < 2.44.3; >= 2.45.0, < 2.45.1 · CVE-2024-28197 · GHSA-mq4x-r2w3-j7mr
- High, CVSS 7.7
raspap-webgui vulnerable to denial of service
Packagist billz/raspap-webgui · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2024-28754 · GHSA-vc9f-mgxr-h32r
- High, CVSS 7.4
WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
PyPI weasyprint · Upgrade to 61.2 or later · >= 61.0, <= 61.1 · CVE-2024-28184 · GHSA-35jj-wx47-4w8r · amended
- Critical, CVSS 9.4
pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user
PyPI pgadmin4 · Upgrade to 8.4 or later · < 8.4 · CVE-2024-2044 · GHSA-rj98-crf4-g69w · amended
- High, CVSS 8.1
kubevirt-csi: PersistentVolume allows access to HCP's root node
Go github.com/kubevirt/csi-driver · Upgrade to 0.0.0-202403081943-cc28dcbb0afc14 (pre-release) or later · < 0.0.0-202403081943-cc28dcbb0afc14 · CVE-2024-1725 · GHSA-fg9q-5cw2-p6r9
- High, CVSS 7.0
Grafana's users with permissions to create a data source can CRUD all data sources
Go github.com/grafana/grafana · Upgrade to 10.3.4, 10.2.5, 10.1.8 or 2 more by release line · >= 8.5.0, < 9.5.7; >= 10.0.0, < 10.0.12; >= 10.1.0, < 10.1.8; >= 10.2.0, < 10.2.5; >= 10.3.0, < 10.3.4 · CVE-2024-1442 · GHSA-5mxf-42f5-j782
- High, CVSS 7.3
Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters
crates.io wasmi · Upgrade to 0.31.1 or later · >= 0.15.0, <= 0.31.0 · CVE-2024-28123 · GHSA-75jp-vq8x-h4cq
- Critical, CVSS 9.3
nGrinder vulnerable to unsafe Java objects deserialization
Maven org.ngrinder:ngrinder-core · Upgrade to 3.5.9 or later · < 3.5.9 · CVE-2024-28213 · GHSA-j7jm-8gf5-frcm
- High, CVSS 7.5
Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials
Go github.com/cloudevents/sdk-go/v2 · Upgrade to 2.15.2 or later · <= 2.15.1 · CVE-2024-28110 · GHSA-5pf6-2qwx-pxm2
- High, CVSS 8.0
Jenkins HTML Publisher Plugin Stored XSS vulnerability
Maven org.jenkins-ci.plugins:htmlpublisher · Upgrade to 1.32.1 or later · < 1.32.1 · CVE-2024-28150 · GHSA-xrrw-9j78-hpf3
- High, CVSS 8.0
Jenkins HTML Publisher Plugin does not properly sanitize input
Maven org.jenkins-ci.plugins:htmlpublisher · Upgrade to 1.32.1 or later · >= 1.16, < 1.32.1 · CVE-2024-28149 · GHSA-8vcg-v7g4-3vr7
- High, CVSS 7.5
Apollo Router's Compressed Payloads do not respect HTTP Payload Limits
crates.io apollo-router · Upgrade to 1.40.2 or later · >= 0.9.5, < 1.40.2 · CVE-2024-28101 · GHSA-cgqf-3cq5-wvcj
- High, CVSS 8.4
RPyC's missing security check results in code execution when using numpy.array on the server-side.
PyPI rpyc · Upgrade to 6.0.0 or later · >= 4.0.0, < 6.0.0 · CVE-2024-27758 · GHSA-h5cg-53g7-gqjw · amended
- High, CVSS 8.4
*const c_void / ExternalPointer unsoundness leading to use-after-free
crates.io Deno · Upgrade to 1.40.3 or later · >= 1.36.2, < 1.40.3 · CVE-2024-27934 · GHSA-3j27-563v-28wf
- High, CVSS 8.2
Deno arbitrary file descriptor close via
op_node_ipc_pipe()leading to permission prompt bypasscrates.io deno · Upgrade to 1.39.1 or later · >= 1.39.0, <= 1.39.0 · CVE-2024-27933 · GHSA-6q4w-9x56-rmwq
- High, CVSS 7.5
PocketMine-MP server crash with certain invalid JSON payloads in
LoginPacketdue to dependency vulnerability (3rd time)Packagist pocketmine/pocketmine-mp · Upgrade to 5.11.1 or later · < 5.11.1 · GHSA-h6j3-j35f-v2x7
- High, CVSS 7.5
PocketMine-MP BookEditPacket crash when inventory slot in the packet is invalid
Packagist pocketmine/pocketmine-mp · Upgrade to 5.11.2 or later · < 5.11.2 · GHSA-xc7j-wj36-qjfr
- High, CVSS 8.8
Remote Code Execution by uploading a phar file using frontmatter
Packagist getgrav/grav · Upgrade to 1.7.43 or later · < 1.7.43 · CVE-2024-27923 · GHSA-f6g2-h7qv-3m5v
- High, CVSS 7.5
CasaOS-UserService allows unauthorized access to any file
Go github.com/IceWhaleTech/CasaOS-UserService · Upgrade to 0.4.7 or later · < 0.4.7 · CVE-2024-24765 · GHSA-h5gf-cmm8-cg7c
- High, CVSS 7.5
Shopware's session is persistent in Cache for 404 pages
Packagist shopware/storefront +1 · Upgrade all 2 to 6.5.8.7 or later · >= 6.5.8.0, < 6.5.8.7 · CVE-2024-27917 · GHSA-c2f9-4jmm-v45m
- Critical, CVSS 9.3
Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability
Maven org.apache.inlong:manager-common · Upgrade to 1.11.0 or later · >= 1.8.0, < 1.11.0 · CVE-2024-26580 · GHSA-p2gx-4434-pf6g
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.