High, CVSS 8.7
Apache DolphinScheduler: Arbitrary js execute as root for authenticated users
Maven org.apache.dolphinscheduler:dolphinscheduler-master · Upgrade to 3.1.9 or later · < 3.1.9 · CVE-2023-49299 · GHSA-v7hg-77v9-2445
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 411 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Infinispan REST Server's bulk read endpoints do not properly evaluate user permissions
Maven org.infinispan:infinispan-server-rest · Upgrade to 15.0.0.Dev04 or 14.0.18.Final by release line · >= 15.0.0.Dev01, < 15.0.0.Dev04; < 14.0.18.Final · CVE-2023-3628 · GHSA-fhr7-8jx4-r9cp
- High, CVSS 7.1
Infinispan REST Server's cache retrieval endpoints do not properly evaluate the necessary admin permissions
Maven org.infinispan:infinispan-server-rest · Upgrade to 15.0.0.Dev04 or 14.0.18.Final by release line · >= 15.0.0.Dev01, < 15.0.0.Dev04; < 14.0.18.Final · CVE-2023-3629 · GHSA-r4w2-hjmr-36m7
- High, CVSS 7.5
Miniflare vulnerable to Server-Side Request Forgery (SSRF)
npm miniflare · Upgrade to 3.20231030.2 or later · >= 3.20230821.0, < 3.20231030.2 · CVE-2023-7078 · GHSA-fwvg-2739-22v7 · amended
- High, CVSS 7.1
Infinispan circular object references causes out of memory errors
Maven org.infinispan.protostream:protostream · Upgrade to 4.6.2.Final or later · < 4.6.2.Final · CVE-2023-5236 · GHSA-488m-w9fp-5mm2
- High, CVSS 8.6
msgpackr's conversion of property names to strings can trigger infinite recursion
npm msgpackr · Upgrade to 1.10.1 or later · < 1.10.1 · CVE-2023-52079 · GHSA-7hpj-7hhx-2fgx · amended
- High, CVSS 7.5
hutool-core was discovered to contain a stack overflow via NumberUtil.toBigDecimal method
Maven cn.hutool:hutool-core · Upgrade to 5.8.25 or later · >= 5.8.22, <= 5.8.24 · CVE-2023-51080 · GHSA-m5hf-m3r2-xq53
- High, CVSS 7.5
hutool-core discovered to contain an infinite loop in the StrSplitter.splitByRegex function
Maven cn.hutool:hutool-core · Upgrade to 5.8.24 or later · <= 5.8.23 · CVE-2023-51075 · GHSA-7m7h-rgvp-3v4r
- High, CVSS 7.8
Buildkite Elastic CI for AWS symbolic link following vulnerability
Go github.com/buildkite/elastic-ci-stack-for-aws/v6 · Upgrade to 6.7.0 or later · < 6.7.0 · CVE-2023-43116 · GHSA-7c44-7j7v-w554
- High, CVSS 7.0
Buildkite Elastic CI for AWS time-of-check-time-of-use race condition vulnerability
Go github.com/buildkite/elastic-ci-stack-for-aws/v6 · Upgrade to 6.7.1 or later · < 6.7.1 · CVE-2023-43741 · GHSA-r5hg-349q-mg2q
- High, CVSS 7.1
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
Maven org.keycloak:keycloak-services · Upgrade to 23.0.3 or later · < 23.0.3 · CVE-2023-6291 · GHSA-mpwq-j3xf-7m5w
- High, CVSS 8.6
Gradio makes the
/filesecure against file traversal and server-side request forgery attacksPyPI gradio · Upgrade to 4.11.0 or later · < 4.11.0 · CVE-2023-51449 · GHSA-6qm2-wpxq-7qh2 · amended
- Critical, CVSS 9.8
Apache IoTDB: Unsafe deserialize map in Sync Tool
Maven org.apache.iotdb:iotdb-parent · Upgrade to 1.2.2 or later · >= 0.13.0, < 1.2.2 · CVE-2023-51656 · GHSA-f23h-52hj-99p6
- High, CVSS 7.8
transformers has a Deserialization of Untrusted Data vulnerability
PyPI transformers · Upgrade to 4.36.0 or later · < 4.36.0 · CVE-2023-7018 · GHSA-v68g-wm8c-6x7j · amended
- High, CVSS 7.6
MainWP Dashboard SQL Command Injection vulnerability
Packagist mainwp/mainwp · Upgrade to 4.4.3.4 or later · <= 4.4.3.3 · CVE-2023-38519 · GHSA-87fg-9x5w-j3rm
- High, CVSS 7.5
Apache Pulsar WebSocket Proxy contains an Improper Authentication vulnerability
Maven org.apache.pulsar:pulsar-websocket · Upgrade to 3.0.1, 2.11.2 or 2.10.5 by release line · < 2.10.5; >= 2.11.0, < 2.11.2; >= 3.0.0, < 3.0.1 · CVE-2023-37544 · GHSA-83q5-whqp-r8jr
- High, CVSS 8.8
MLflow Path Traversal Vulnerability
PyPI mlflow · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2023-6976 · GHSA-wv8q-4f85-2p8p · amended
- High, CVSS 7.5
MLflow Local File Disclosure Vulnerability
PyPI mlflow · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2023-6977 · GHSA-qg8p-32gr-gh6x · amended
- Critical, CVSS 9.8
MLFlow Path Traversal Vulnerability
PyPI mlflow · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2023-6975 · GHSA-hh8p-p8mp-gqhm · amended
- Critical, CVSS 9.8
MLflow Server-Side Request Forgery (SSRF)
PyPI mlflow · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2023-6974 · GHSA-59v3-898r-qwhj · amended
- High, CVSS 8.7
MLflow Path Traversal Vulnerability
PyPI mlflow · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2023-6909 · GHSA-5r3q-93q3-f978 · amended
- High, CVSS 8.6
Authentication bypass vulnerability in navidrome's subsonic endpoint
Go github.com/navidrome/navidrome · Upgrade to 0.50.2 or later · <= 0.50.1 · CVE-2023-51442 · GHSA-wq59-4q6r-635r
- High, CVSS 8.1
Expired tokens can be renewed without validating the account password
PyPI emailproxy · Upgrade to 2023.12.19 or later · <= 2023.11.18 · GHSA-9wgg-m99q-hhfc · amended
- High, CVSS 8.3
Velocity execution without script right through tree macro
Maven org.xwiki.platform:xwiki-platform-index-tree-macro · Upgrade to 15.2-rc-1 (pre-release) or 14.10.7 by release line · >= 8.3-rc-1, < 14.10.7; >= 15.0-rc-1, < 15.2-rc-1 · CVE-2023-50732 · GHSA-p5f8-qf24-24cj
- Critical, CVSS 9.0
transformers has a Deserialization of Untrusted Data vulnerability
PyPI transformers · Upgrade to 4.36.0 or later · < 4.36.0 · CVE-2023-6730 · GHSA-3863-2447-669p · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.