Critical, CVSS 9.8
Symfony XML decoding attack vector through external entities
Packagist symfony/symfony · Upgrade to 2.0.11 or later · >= 2.0.0, < 2.0.11 · GHSA-mmcv-fvq8-r9x3
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
Symfony XML decoding attack vector through external entities
Packagist symfony/serializer · Upgrade to 2.0.11 or later · >= 2.0.0, < 2.0.11 · GHSA-j68w-pg49-f6vx
- High, CVSS 7.5
Symfony XXE security vulnerability
Packagist symfony/routing · Upgrade to 2.0.17 or later · >= 2.0.0, < 2.0.17 · GHSA-rjpm-qmq7-q85w
- High, CVSS 7.5
Symfony allows direct access of ESI URLs behind a trusted proxy
Packagist symfony/symfony +1 · Upgrade all 2 to 2.5.4, 2.4.9 or 2.3.19 by release line · >= 2.0.0, < 2.3.19; >= 2.4.0, < 2.4.9; >= 2.5.0, < 2.5.4 · CVE-2014-5245 · GHSA-wvjv-p5rr-mmqm
- High, CVSS 7.5
Symfony vulnerable to denial of service via a malicious HTTP Host header
Packagist symfony/symfony +1 · Upgrade all 2 to 2.5.4, 2.4.9 or 2.3.19 by release line · >= 2.0.0, < 2.3.19; >= 2.4.0, < 2.4.9; >= 2.5.0, < 2.5.4 · CVE-2014-5244 · GHSA-v77v-x634-9m56
- High, CVSS 7.5
Code injection in the way Symfony implements translation caching in FrameworkBundle
Packagist symfony/symfony · Upgrade to 2.5.4, 2.4.9 or 2.3.19 by release line · >= 2.0.0, < 2.3.19; >= 2.4.0, < 2.4.9; >= 2.5.0, < 2.5.4 · +1 more package · CVE-2014-4931 · GHSA-wfv7-5x33-v22h
- High, CVSS 7.5
Symfony XML Entity Expansion security vulnerability
Packagist symfony/dependency-injection · Upgrade to 2.0.17 or later · >= 2.0.0, < 2.0.17 · GHSA-c636-cg5r-2498
- High, CVSS 7.3
Smarty vulnerable to PHP Code Injection by malicious attribute in extends-tag
Packagist smarty/smarty · Upgrade to 5.1.1 or 4.5.3 by release line · >= 5.0.0, < 5.1.1; >= 3.0.0, < 4.5.3 · CVE-2024-35226 · GHSA-4rmg-292m-wg3w
- High, CVSS 8.2
ansibleguy-webui Cross-site Scripting vulnerability
PyPI ansibleguy-webui · Upgrade to 0.0.21 or later · < 0.0.21 · CVE-2024-36110 · GHSA-927p-xrc2-x2gj · amended
- Critical, CVSS 9.8
Mocodo vulnerable to SQL injection in
/web/generate.phpPyPI mocodo · Upgrade to 4.2.7 or later · <= 4.2.6 · CVE-2024-35374 · GHSA-j6cv-98jx-mrwr · amended
- High, CVSS 8.8
silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source)
Packagist silverstripe/subsites · Upgrade to 2.1.1 or later · >= 2.0.0, < 2.1.1 · GHSA-xc69-p8fc-m6m5
- High, CVSS 7.5
silverstripe/taxonomy SQL Injection vulnerability
Packagist silverstripe/taxonomy · Upgrade to 2.0.1 or 1.3.1 by release line · >= 1.3.0, < 1.3.1; >= 2.0.0, < 2.0.1 · GHSA-p2v5-xcqm-4fv6
- High, CVSS 8.6
rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter
RubyGems rack-contrib · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2024-35231 · GHSA-8c8q-2xw3-j869
- High, CVSS 8.3
OpenAPI Generator Online - Arbitrary File Read/Delete
Maven org.openapitools:openapi-generator-online · Upgrade to 7.6.0 or later · < 7.6.0 · CVE-2024-35219 · GHSA-g3hr-p86p-593h
- High, CVSS 7.3
silverstripe/graphql Cross-Site Request Forgery vulnerability
Packagist silverstripe/graphql · Upgrade to 2.0.3 or later · >= 2.0.0, < 2.0.3 · GHSA-wjg9-v8cf-f5q2
- High, CVSS 8.8
silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector
Packagist silverstripe/framework · Upgrade to 4.2.3, 4.1.4 or 4.0.6 by release line · >= 4.0.0-rc1, < 4.0.6; >= 4.1.0-rc1, < 4.1.4; >= 4.2.0-rc1, < 4.2.3 · GHSA-265q-222x-52m6
- High, CVSS 7.5
silverstripe/framework has possible denial of service attack vector when flushing
Packagist silverstripe/framework · Upgrade to 4.2.2, 4.1.3 or 4.0.5 by release line · >= 4.0.0-rc1, < 4.0.5; >= 4.1.0-rc1, < 4.1.3; >= 4.2.0-rc1, < 4.2.2 · GHSA-cwgq-83w5-8jfq
- High, CVSS 8.8
silverstripe/framework allows upload of dangerous file types
Packagist silverstripe/framework · Upgrade to 4.1.1, 4.0.4 or 3.6.6 by release line · >= 3.6.5-rc1, < 3.6.6; >= 4.0.3-rc1, < 4.0.4; >= 4.1.0-rc1, < 4.1.1 · GHSA-vcg6-8fxc-x5cq
- High, CVSS 7.5
silverstripe/framework code execution vulnerability
Packagist silverstripe/framework · Upgrade to 4.1.1 or 4.0.4 by release line · >= 4.0.3-rc1, < 4.0.4; >= 4.1.0-rc1, < 4.1.1 · GHSA-vgxh-x8jv-hmff
- High, CVSS 7.5
silverstripe/framework BackURL validation bypass with malformed URLs
Packagist silverstripe/framework · Upgrade to 4.1.1 or 4.0.4 by release line · >= 4.0.0-rc1, < 4.0.4; >= 4.1.0-rc1, < 4.1.1 · GHSA-m5q3-mvcr-gc5m
- High, CVSS 8.8
silverstripe/framework SQL injection in full text search
Packagist silverstripe/framework · Upgrade to 4.0.1, 3.6.3 or 3.5.6 by release line · >= 3.5.0-rc1, < 3.5.6; >= 3.6.0-rc1, < 3.6.3; >= 4.0.0-rc1, < 4.0.1 · GHSA-xx4r-5265-48j6
- High, CVSS 8.0
silverstripe/framework CSV Excel Macro Injection
Packagist silverstripe/framework · Upgrade to 4.0.1, 3.6.3 or 3.5.6 by release line · >= 3.5.0-rc1, < 3.5.6; >= 3.6.0-rc1, < 3.6.3; >= 4.0.0-rc1, < 4.0.1 · GHSA-mqjc-x563-c9q8
- High, CVSS 7.5
silverstripe/framework's User-Agent header not correctly invalidating user session
Packagist silverstripe/framework · Upgrade to 3.6.3 or 3.5.6 by release line · >= 3.5.0-rc1, < 3.5.6; >= 3.6.0-rc1, < 3.6.3 · GHSA-4qx8-j9vh-2628
- High, CVSS 7.5
Soot Infinite Loop vulnerability
Maven org.soot-oss:soot · Upgrade to 4.4.1 or later · < 4.4.1 · CVE-2023-46442 · GHSA-hfg7-j82c-fr3w
- Critical, CVSS 9.1
Silverstripe Brute force bypass on default admin
Packagist silverstripe/framework · Upgrade to 3.3.2, 3.2.4 or 3.1.19 by release line · >= 3.1.18, < 3.1.19; >= 3.2.3, < 3.2.4; >= 3.3.1, < 3.3.2 · GHSA-8v6m-7f5v-hhx6
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.