High, CVSS 7.5
fonttools XML External Entity Injection (XXE) Vulnerability
PyPI fonttools · Upgrade to 4.43.0 or later · >= 4.28.2, < 4.43.0 · CVE-2023-45139 · GHSA-6673-4983-2vx5 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.0
snapd Race Condition vulnerability
Go github.com/snapcore/snapd · Upgrade to 2.57.6 or later · < 2.57.6 · CVE-2022-3328 · GHSA-cjqf-877p-7m3f
- High, CVSS 7.5
XWiki vulnerable to Denial of Service attack through attachments
Maven org.xwiki.platform:xwiki-platform-distribution-war · Upgrade to 15.8-rc-1 (pre-release), 15.5.3 or 14.10.18 by release line · >= 14.10, < 14.10.18; >= 15.0-rc-1, < 15.5.3; >= 15.6-rc-1, < 15.8-rc-1 · CVE-2024-21651 · GHSA-8959-rfxh-r4j4
- Critical, CVSS 10.0
XWiki Remote Code Execution Vulnerability via User Registration
Maven org.xwiki.platform:xwiki-platform-administration-ui · Upgrade to 15.8-rc-1 (pre-release), 15.5.3 or 14.10.17 by release line · >= 2.2, < 14.10.17; >= 15.0-rc-1, < 15.5.3; >= 15.6-rc-1, < 15.8-rc-1 · CVE-2024-21650 · GHSA-rj7p-xjv7-7229
- High, CVSS 8.0
XWiki has no right protection on rollback action
Maven org.xwiki.platform:xwiki-platform · Upgrade to 15.8-rc-1 (pre-release) or 15.5.3 by release line · >= 15.0-rc-1, < 15.5.3; >= 15.6-rc-1, < 15.8-rc-1 · +1 more package · CVE-2024-21648 · GHSA-xh35-w7wg-95v3
- High, CVSS 7.5
pyload Unauthenticated Flask Configuration Leakage vulnerability
PyPI pyload-ng · Upgrade to 0.5.0b3.dev77 (pre-release) or later · < 0.5.0b3.dev77 · CVE-2024-21644 · GHSA-mqpq-2p68-46fv · amended
- High, CVSS 7.5
D-Tale server-side request forgery through Web uploads
PyPI dtale · Upgrade to 3.9.0 or later · < 3.9.0 · CVE-2024-21642 · GHSA-7hfx-h3j3-rwq4 · amended
- High, CVSS 7.1
PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption
PyPI pycryptodome +1 · Upgrade all 2 to 3.19.1 or later · < 3.19.1 · CVE-2023-52323 · GHSA-j225-cvw7-qrx7 · amended
- High, CVSS 7.5
Froxlor username/surname AND company field Bypass
Packagist froxlor/froxlor · Upgrade to 2.1.2 or later · <= 2.1.1 · CVE-2023-50256 · GHSA-625g-fm5w-w7w4
- High, CVSS 7.3
@backstage/backend-app-api leaks GitLab access tokens
npm @backstage/backend-app-api · Upgrade to 0.5.9-next.1 (pre-release) or later · < 0.5.9-next.1 · CVE-2023-6944 · GHSA-86rg-pf4c-5grg · amended
- High, CVSS 8.6
Omniauth::MicrosoftGraph Account takeover (nOAuth)
RubyGems omniauth-microsoft_graph · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2024-21632 · GHSA-5g66-628f-7cvj
- High, CVSS 8.1
PrestaShop some attribute not escaped in Validate::isCleanHTML method
Packagist prestashop/prestashop · Upgrade to 8.1.3 or 1.7.8.11 by release line · >= 8.0.0-beta.1, < 8.1.3; < 1.7.8.11 · CVE-2024-21627 · GHSA-xgpm-q3mq-46rq
- Critical, CVSS 9.3
Arbitrary remote code execution within
wrangler devWorkers sandboxnpm wrangler · Upgrade to 3.19.0 or 2.20.2 by release line · >= 3.0.0, < 3.19.0; >= 2.0.0, < 2.20.2 · CVE-2023-7080 · GHSA-f8mp-x433-5wpf · amended
- High, CVSS 8.2
Insecure random string generator used for sensitive data
Go github.com/cubefs/cubefs · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2023-46740 · GHSA-4248-p65p-hcrm
- High, CVSS 8.2
CubeFS timing attack can leak user passwords
Go github.com/cubefs/cubefs · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2023-46739 · GHSA-8579-7p32-f398
- High, CVSS 7.1
Authenticated users can crash the CubeFS servers with maliciously crafted requests
Go github.com/cubefs/cubefs · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2023-46738 · GHSA-qc6v-g3xw-grmx
- Critical, CVSS 9.8
Apache InLong Manager Remote Code Execution vulnerability
Maven org.apache.inlong:manager-pojo · Upgrade to 1.10.0 or later · >= 1.5.0, < 1.10.0 · CVE-2023-51784 · GHSA-9xg9-hh45-xcm6
- High, CVSS 7.5
Apache InLong Manager Arbitrary File Read Vulnerability
Maven org.apache.inlong:manager-pojo · Upgrade to 1.10.0 or later · >= 1.5.0, < 1.10.0 · CVE-2023-51785 · GHSA-crwj-2r3c-gx2g
- High, CVSS 8.2
PaddlePaddle stack overflow in paddle.linalg.lu_unpack
PyPI paddlepaddle · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2023-52307 · GHSA-g57v-2687-jx33 · amended
- Critical, CVSS 9.6
PaddlePaddle command injection in convert_shape_compare
PyPI paddlepaddle · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2023-52314 · GHSA-3cr5-2446-8pg3 · amended
- Critical, CVSS 9.6
PaddlePaddle command injection in get_online_pass_interval
PyPI paddlepaddle · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2023-52310 · GHSA-j5h9-9r39-43q5 · amended
- High, CVSS 8.2
PaddlePaddle stack overflow in paddle.searchsorted
PyPI paddlepaddle · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2023-52304 · GHSA-4rrv-8gcp-24v8 · amended
- High, CVSS 8.2
PaddlePaddle heap buffer overflow in paddle.repeat_interleave
PyPI paddlepaddle · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2023-52309 · GHSA-8fp7-jwv2-49x9 · amended
- Critical, CVSS 9.6
PaddlePaddle command injection in _wget_download
PyPI paddlepaddle · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2023-52311 · GHSA-rf7p-79xq-8xwm · amended
- Critical, CVSS 9.8
plotly.js prototype pollution vulnerability
Packagist plotly/plotly.js +1 · Upgrade all 2 to 2.25.2 or later · < 2.25.2 · CVE-2023-46308 · GHSA-wjc4-73q6-gv3m · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.