Critical, CVSS 9.0
transformers has a Deserialization of Untrusted Data vulnerability
PyPI transformers · Upgrade to 4.36.0 or later · < 4.36.0 · CVE-2023-6730 · GHSA-3863-2447-669p · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 412 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 566 in the 30 days before.
- Critical
- 67 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
Pedroetb TTS-API OS Command Injection
npm tts-api · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2019-25158 · GHSA-jx6q-fq9h-6g7q · amended
- High, CVSS 7.7
Apache Superset incorrect write permissions vulnerability
PyPI apache-superset · Upgrade to 3.0.2 or 2.1.3 by release line · < 2.1.3; >= 3.0.0, < 3.0.2 · CVE-2023-49734 · GHSA-g49j-j489-3xpf · amended
- High, CVSS 8.8
mlflow Command Injection vulnerability
PyPI mlflow · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2023-6940 · GHSA-hvc6-42vf-jhf8 · amended
- High, CVSS 7.5
Sentry's Astro SDK vulnerable to ReDoS
npm @sentry/astro · Upgrade to 7.87.0 or later · >= 7.78.0, < 7.87.0 · CVE-2023-50249 · GHSA-x3v3-8xg8-8v72 · amended
- High, CVSS 8.2
Unauthenticated Denial of Service in the octokit/webhooks library
npm octokit · Upgrade to 3.1.2 or later · < 3.1.2 · +3 more packages · CVE-2023-50728 · GHSA-pwfr-8pq7-x9qv · amended
- Critical, CVSS 9.9
Remote code execution/programming rights with configuration section from any user account
Maven org.xwiki.platform:xwiki-platform-administration-ui · Upgrade to 15.7-rc-1 (pre-release), 15.5.2 or 14.10.15 by release line · >= 2.3, < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1 · CVE-2023-50723 · GHSA-qj86-p74r-7wp5
- Critical, CVSS 9.6
XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass
Maven org.xwiki.platform:xwiki-platform-administration-ui · Upgrade to 15.7-rc-1 (pre-release), 15.5.2 or 14.10.15 by release line · >= 2.3, < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1 · CVE-2023-50722 · GHSA-cp3j-273x-3jxc
- Critical, CVSS 9.9
Remote code execution from account through SearchAdmin
Maven org.xwiki.platform:xwiki-platform-search-ui · Upgrade to 15.7-rc-1 (pre-release), 15.5.2 or 14.10.15 by release line · >= 4.5-rc-1, < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1 · CVE-2023-50721 · GHSA-7654-vfh6-rw6x
- High, CVSS 7.5
Solr search discloses password hashes of all users
Maven org.xwiki.platform:xwiki-platform-search-solr-api · Upgrade to 15.7-rc-1 (pre-release), 15.5.2 or 14.10.15 by release line · >= 7.2-milestone-2, < 14.10.15; >= 15.0-rc-1, < 15.5.2; >= 15.6-rc-1, < 15.7-rc-1 · CVE-2023-50719 · GHSA-p6cp-6r35-32mh
- High, CVSS 8.4
Potential CSV export data leak
RubyGems activeadmin · Upgrade to 2.12.0 or later · < 2.12.0 · CVE-2023-50448 · GHSA-356j-hg45-x525
- High, CVSS 8.5
Multiple WSO2 products vulnerable to perform user impersonatoin using JIT provisioning
Maven org.wso2.identity.apps:authentication-portal · Upgrade to 1.6.179.1 or later · < 1.6.179.1 · +1 more package · CVE-2023-6837 · GHSA-f6jm-9pr8-9c3w
- Critical, CVSS 9.8
Apache Dubbo: Bypass deny serialize list check in Apache Dubbo
Maven org.apache.dubbo:dubbo · Upgrade to 3.1.6 or later · >= 3.1.5, <= 3.1.5 · CVE-2023-46279 · GHSA-97rv-88gf-phvr
- Critical, CVSS 9.8
Bypass serialize checks in Apache Dubbo
Maven org.apache.dubbo:dubbo · Upgrade to 3.2.5 or 3.1.11 by release line · >= 3.1.0, < 3.1.11; >= 3.2.0, < 3.2.5 · CVE-2023-29234 · GHSA-6x49-w35h-wqrj
- High, CVSS 8.8
GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182
PyPI mindsdb · Upgrade to 23.11.4.1 or later · < 23.11.4.1 · CVE-2023-50731 · GHSA-j8w6-2r9h-cxhj · amended
- Critical, CVSS 10.0
Path traversal in MLflow
PyPI mlflow · Upgrade to 2.9.2 or later · < 2.9.2 · CVE-2023-6831 · GHSA-554w-xh4j-8w64 · amended
- High, CVSS 7.7
Allocation of Resources Without Limits in Keycloak
Maven org.keycloak:keycloak-model-jpa · Upgrade to 21.0.0 or later · < 21.0.0 · CVE-2023-6563 · GHSA-54f3-c6hg-865h
- Critical, CVSS 9.6
Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability
PyPI gradio · Upgrade to 4.14.0 or later · < 4.14.0 · CVE-2023-6572 · GHSA-gqvf-3hgp-5hxv · amended
- Critical, CVSS 9.3
External Control of File Name or Path in h2oai/h2o-3
PyPI h2o · Upgrade to 3.46.0.1 or later · < 3.46.0.1 · CVE-2023-6569 · GHSA-gqrq-j6pm-98c2 · amended
- High, CVSS 8.8
Configuration Injection in extension "Direct Mail" (direct_mail)
Packagist directmailteam/direct-mail · Upgrade to 9.5.2, 7.0.3 or 6.0.3 by release line · >= 8.0.0, < 9.5.2; >= 7.0.0, < 7.0.3; < 6.0.3 · CVE-2023-50461 · GHSA-p6xx-fhfw-7mj7
- High, CVSS 7.1
Jenkins Nexus Platform Plugin Cross-Site Request Forgery vulnerability
Maven org.sonatype.nexus.ci:nexus-jenkins-plugin · Upgrade to 3.18.1-01 (pre-release) or later · < 3.18.1-01 · CVE-2023-50766 · GHSA-4gfc-72gw-v385
- High, CVSS 7.1
Jenkins Nexus Platform Plugin missing permission check
Maven org.sonatype.nexus.ci:nexus-jenkins-plugin · Upgrade to 3.18.1-01 (pre-release) or later · < 3.18.1-01 · CVE-2023-50767 · GHSA-9vrm-747r-668v
- High, CVSS 8.8
Cross Site Request Forgery in Silverpeas
Maven org.silverpeas.core:silverpeas-core · Upgrade to 6.3.2 or later · < 6.3.2 · CVE-2023-47326 · GHSA-gqgv-7wpj-vm6q
- High, CVSS 8.8
Cross Site Request Forgery in Silverpeas
Maven org.silverpeas.core:silverpeas-core-web · Upgrade to 6.3.2 or later · < 6.3.2 · CVE-2023-47322 · GHSA-g27c-w2v7-88xp
- High, CVSS 7.5
Missing access control in Silverpeas
Maven org.silverpeas.core:silverpeas-core-api +1 · Upgrade all 2 to 6.3.2 or later · < 6.3.2 · CVE-2023-47323 · GHSA-cwh6-hm53-6w2m
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.