High, CVSS 8.8
Deno's deno_runtime vulnerable to interactive permission prompt spoofing via improper ANSI stripping
crates.io deno_runtime · Upgrade to 0.147.0 or later · >= 0.103.0, < 0.147.0 · +1 more package · CVE-2024-27936 · GHSA-m4pq-fv2w-6hrw
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.2
Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination
crates.io deno · Upgrade to 1.36.3 or later · >= 1.35.1, < 1.36.3 · CVE-2024-27935 · GHSA-wrqv-pf6j-mqjp
- High, CVSS 7.1
Use After Free in SixLabors.ImageSharp
NuGet sixlabors.imagesharp · Upgrade to 3.1.3 or 2.1.7 by release line · >= 3.0.0, < 3.1.3; < 2.1.7 · CVE-2024-27929 · GHSA-65x7-c272-7g7r
- Critical, CVSS 9.8
HTTP Handling Vulnerability in the Bare server
npm @tomphttp/bare-server-node · Upgrade to 2.0.2 or later · < 2.0.2 · CVE-2024-27922 · GHSA-86fc-f9gr-v533 · amended
- High, CVSS 7.1
GetRepositoryByName,DeleteRepositoryByNameandGetArtifactByNameallow access of arbitrary repositories in Minder by any authenticated userGo github.com/stacklok/minder · Upgrade to 0.0.33 or later · < 0.0.33 · CVE-2024-27916 · GHSA-v627-69v2-xx37
- High, CVSS 8.1
Incorrect TLS certificate auth method in Vault
Go github.com/hashicorp/vault · Upgrade to 1.15.5 or 1.14.10 by release line · >= 1.15.0, < 1.15.5; < 1.14.10 · CVE-2024-2048 · GHSA-r3w7-mfpm-c2vw
- High, CVSS 8.1
pgproto3 SQL Injection via Protocol Message Size Overflow
Go github.com/jackc/pgproto3 +1 · Upgrade all 2 to 2.3.3 or later · < 2.3.3 · GHSA-7jwh-3vrq-q3m8
- High, CVSS 7.5
Mio's tokens for named pipes may be delivered after deregistration
crates.io mio · Upgrade to 0.8.11 or later · >= 0.7.2, <= 0.8.10 · CVE-2024-27308 · GHSA-r8w9-5wcg-vfj7
- High, CVSS 8.1
pgx SQL Injection via Protocol Message Size Overflow
Go github.com/jackc/pgx · Upgrade to 5.5.4 or 4.18.2 by release line · < 4.18.2; >= 5.0.0, < 5.5.4 · +2 more packages · CVE-2024-27304 · GHSA-mrww-27vc-gghv
- Critical, CVSS 9.8
JSONata expression can pollute the "Object" prototype
npm jsonata · Upgrade to 2.0.4 or 1.8.7 by release line · >= 1.4.0, < 1.8.7; >= 2.0.0, < 2.0.4 · CVE-2024-27307 · GHSA-fqg8-vfv7-8fj8 · amended
- High, CVSS 7.3
electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)
npm app-builder-lib · Upgrade to 24.13.2 or later · < 24.13.2 · CVE-2024-27303 · GHSA-r4pf-3v7r-hh55 · amended
- Critical, CVSS 9.1
Authorization Bypass Through User-Controlled Key in go-zero
Go github.com/zeromicro/go-zero · Upgrade to 1.4.4 or later · < 1.4.4 · CVE-2024-27302 · GHSA-fgxv-gw55-r5fq
- High, CVSS 8.7
pgx SQL Injection via Line Comment Creation
Go github.com/jackc/pgx +1 · Upgrade all 2 to 4.18.2 or later · < 4.18.2 · CVE-2024-27289 · GHSA-m7wr-2xf7-cm9p
- High, CVSS 7.3
Integer overflow in chunking helper causes dispatching to miss elements or panic
Go github.com/authzed/spicedb · Upgrade to 1.29.2 or later · < 1.29.2 · CVE-2024-27101 · GHSA-h3m7-rqc4-7h9p
- High, CVSS 7.2
ESPHome vulnerable to remote code execution via arbitrary file write
PyPI esphome · Upgrade to 2024.2.1 or later · >= 2023.12.9, <= 2023.12.9 · CVE-2024-27081 · GHSA-8p25-3q46-8q2p · amended
- Critical, CVSS 9.8
Budibase affected by VM2 Constructor Escape Vulnerability
npm @budibase/server · Upgrade to 2.20.0 or later · < 2.20.0 · GHSA-4g2x-vq5p-5vj6 · amended
- Critical, CVSS 10.0
ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
npm parse-server · Upgrade to 7.0.0-alpha.20 (pre-release) or 6.5.0 by release line · < 6.5.0; >= 7.0.0-alpha.1, < 7.0.0-alpha.20 · CVE-2024-27298 · GHSA-6927-3vr9-fxf2 · amended
- High, CVSS 8.2
Directus has MySQL accent insensitive email matching
npm directus · Upgrade to 10.8.3 or later · <= 10.8.2 · CVE-2024-27295 · GHSA-qw9g-7549-7wg5 · amended
- High, CVSS 7.5
Docassemble unauthorized access through URL manipulation
PyPI docassemble-webapp +1 · Upgrade all 2 to 1.4.97 or later · >= 1.4.53, < 1.4.97 · CVE-2024-27292 · GHSA-jq57-3w7p-vwvv · amended
- High, CVSS 7.1
Mattermost post fetching without auditing in compliance export
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 9.3.1, 9.2.5 or 8.1.9 by release line · >= 9.3.0, < 9.3.1; >= 9.2.0, < 9.2.5; < 8.1.9 · CVE-2024-1887 · GHSA-fx48-xv6q-6gp3
- High, CVSS 7.5
Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service
Maven org.clojure:clojure · Upgrade to 1.12.0-alpha9 (pre-release) or 1.11.2 by release line · >= 1.7.0, < 1.11.2; >= 1.12.0-alpha1, < 1.12.0-alpha9 · CVE-2024-22871 · GHSA-vr64-r9qj-h27f
- Critical, CVSS 9.1
Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID
PyPI flask-appbuilder · Upgrade to 4.3.11 or later · < 4.3.11 · CVE-2024-25128 · GHSA-j2pw-vp55-fqqj · amended
- Critical, CVSS 9.1
Transparent TLS may not be applied to Marbles with certain manifest configurations
Go github.com/edgelesssys/marblerun · Upgrade to 1.4.1 or later · < 1.4.1 · GHSA-x5r5-2qrx-rqj8
- High, CVSS 7.1
ZenML Server Remote Privilege Escalation Vulnerability
PyPI zenml · Upgrade to 0.46.7, 0.44.4, 0.43.1 or 0.42.2 by release line · < 0.42.2; >= 0.43.0, <= 0.43.0; >= 0.45.0, < 0.46.7; >= 0.44.0, < 0.44.4 · CVE-2024-25723 · GHSA-vf7j-cmrj-pmmm · amended
- High, CVSS 7.1
SMTP smuggling in Apache James
Maven org.apache.james:james-server · Upgrade to 3.8.1 or 3.7.5 by release line · < 3.7.5; >= 3.8.0, <= 3.8.0 · CVE-2023-51747 · GHSA-p5q9-86w4-2xr5
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.