High, CVSS 7.1
Jenkins MATLAB Plugin missing permission checks
Maven org.jenkins-ci.plugins:matlab · Upgrade to 2.11.1 or later · < 2.11.1 · CVE-2023-49654 · GHSA-cv4x-9f34-8rp9
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.1
Jenkins MATLAB Plugin XML External Entity vulnerability
Maven org.jenkins-ci.plugins:matlab · Upgrade to 2.11.1 or later · < 2.11.1 · CVE-2023-49656 · GHSA-82q9-88m2-4v68
- High, CVSS 7.1
logback serialization vulnerability
Maven ch.qos.logback:logback-core +1 · Upgrade all 2 to 1.4.12, 1.3.12 or 1.2.13 by release line · >= 1.4.0, < 1.4.12; >= 1.3.0, < 1.3.12; < 1.2.13 · CVE-2023-6378 · GHSA-vmq6-5m68-f53m
- High, CVSS 7.3
Apache Superset - Elevation of Privilege
PyPI apache-superset · Upgrade to 2.1.2 or later · < 2.1.2 · CVE-2023-40610 · GHSA-f678-j579-4xf5 · amended
- High, CVSS 7.5
Validation of SignedInfo
Packagist simplesamlphp/xml-security · Upgrade to 1.6.12 or later · >= 1.6.11, <= 1.6.11 · +1 more package · CVE-2023-49087 · GHSA-ww7x-3gxh-qm6r
- High, CVSS 7.5
Apache Tomcat Improper Input Validation vulnerability
Maven org.apache.tomcat:tomcat-catalina · Upgrade to 11.0.0-M11 (pre-release), 10.1.16, 9.0.83 or 8.5.96 by release line · >= 11.0.0-M1, < 11.0.0-M11; >= 10.1.0-M1, < 10.1.16; >= 9.0.0-M1, < 9.0.83; >= 8.5.0, < 8.5.96 · +2 more packages · CVE-2023-46589 · GHSA-fccv-jmmp-qg76
- High, CVSS 8.8
Apache ActiveMQ Deserialization of Untrusted Data vulnerability
Maven org.apache.activemq:apache-activemq · Upgrade to 5.17.4 or 5.16.6 by release line · < 5.16.6; >= 5.17.0, < 5.17.4 · CVE-2022-41678 · GHSA-53v4-42fg-g287
- High, CVSS 7.5
Reactor Netty HTTP Server denial of service vulnerability
Maven io.projectreactor.netty:reactor-netty-core · Upgrade to 1.1.13 or 1.0.39 by release line · >= 1.1.0, < 1.1.13; >= 1.0.0, < 1.0.39 · CVE-2023-34054 · GHSA-q24v-hpg3-v3jp
- High, CVSS 7.5
Spring Framework vulnerable to denial of service
Maven org.springframework:spring-webmvc · Upgrade to 6.0.14 or later · >= 6.0.0, < 6.0.14 · CVE-2023-34053 · GHSA-v94h-hvhg-mf9h
- High, CVSS 7.9
Improper Neutralization of Input in Advanced User Interface for Jolt
Maven org.apache.nifi:nifi-jolt-transform-json-ui · Upgrade to 1.24.0 or later · < 1.24.0 · CVE-2023-49145 · GHSA-68pr-6fjc-wmgm
- High, CVSS 8.5
OroPlatform vulnerable to path traversal during temporary file manipulations
Packagist oro/platform · Upgrade to 5.0.8; some affected versions have no fix yet · >= 4.1.0, <= 4.1.13; >= 4.2.0, <= 4.2.10; >= 5.0.0, < 5.0.8 · CVE-2022-41951 · GHSA-9v3j-4j64-p937
- High, CVSS 8.4
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
Packagist pimcore/admin-ui-classic-bundle · Upgrade to 1.2.2 or later · < 1.2.2 · CVE-2023-49075 · GHSA-9wwg-r3c7-4vfg
- High, CVSS 7.5
sequelize-typescript Prototype Pollution vulnerability
npm sequelize-typescript · Upgrade to 2.1.6 or later · < 2.1.6 · CVE-2023-6293 · GHSA-7pvx-4585-hqww · amended
- Critical, CVSS 9.8
Capsule Proxy Authentication bypass using an empty token
Go github.com/clastix/capsule-proxy +1 · Upgrade all 2 to 0.4.6 or later · <= 0.4.5 · CVE-2023-48312 · GHSA-fpvw-6m5v-hqfp
- Critical, CVSS 9.1
SQL injection vulnerability in Meshery
Go github.com/layer5io/meshery · Upgrade to 0.6.179 or later · < 0.6.179 · CVE-2023-46575 · GHSA-9jjc-grg5-67gj
- High, CVSS 7.5
Apache DolphinScheduler sensitive information disclosure
Maven org.apache.dolphinscheduler:dolphinscheduler +1 · Upgrade all 2 to 3.0.2 or later · >= 3.0.0, < 3.0.2 · CVE-2023-48796 · GHSA-4vvc-r4p4-qgrr · amended
- High, CVSS 7.1
Cross-site Scripting potential in custom links, job buttons, and computed fields
PyPI nautobot · Upgrade to 2.0.5 or 1.6.6 by release line · < 1.6.6; >= 2.0.0, < 2.0.5 · CVE-2023-48705 · GHSA-cf9f-wmhp-v4pr · amended
- High, CVSS 7.5
Cross-site Scripting via uploaded assets
Packagist statamic/cms · Upgrade to 4.36.0 or 3.4.15 by release line · < 3.4.15; >= 4.0.0, < 4.36.0 · CVE-2023-48701 · GHSA-8jjh-j3c2-cjcv
- High, CVSS 8.8
Cross Site Request Forgery in SwiftyEdit
Packagist swiftyedit/swiftyedit · Upgrade to 1.2.0 or later · < 1.2.0 · CVE-2023-47350 · GHSA-2492-xxqf-6h78
- Critical, CVSS 9.8
SQL injection in Apache Submarine
PyPI apache-submarine · Upgrade to 0.8.0 or later · >= 0.7.0, < 0.8.0 · CVE-2023-37924 · GHSA-v5gj-fx3g-hcpw · amended
- High, CVSS 7.0
APM Java Agent Local Privilege Escalation issue
Maven co.elastic.apm:elastic-apm-agent +1 · Upgrade all 2 to 1.27.1 or later · >= 1.18.0, < 1.27.1 · CVE-2021-37942 · GHSA-5xqm-hc45-f2g2
- High, CVSS 7.6
Download to arbitrary folder can lead to RCE
PyPI pyload-ng · Upgrade to 0.5.0b3.dev75 (pre-release) or later · < 0.5.0b3.dev75 · CVE-2023-47890 · GHSA-h73m-pcfw-25h2 · amended
- High, CVSS 8.4
Eval Injection in fastbots
PyPI fastbots · Upgrade to 0.1.5 or later · < 0.1.5 · CVE-2023-48699 · GHSA-vccg-f4gp-45x9 · amended
- High, CVSS 8.8
Cross-Site Request Forgery with QueryOnXWiki allows arbitrary database queries
Maven org.xwiki.contrib:xwiki-application-admintools · Upgrade to 4.5.1 or later · < 4.5.1 · CVE-2023-48293 · GHSA-4f4c-rhjv-4wgv
- Critical, CVSS 9.6
Run Shell Command allows Cross-Site Request Forgery
Maven org.xwiki.contrib:xwiki-application-admintools · Upgrade to 4.5.1 or later · >= 4.4, < 4.5.1 · CVE-2023-48292 · GHSA-8jpr-ff92-hpf9
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.