High, CVSS 8.1
yiisoft/yii deserializing untrusted user input can lead to remote code execution
Packagist yiisoft/yii · Upgrade to 1.1.29 or later · < 1.1.29 · CVE-2023-47130 · GHSA-mw2w-2hj2-fg8q
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Kubernetes Improper Input Validation vulnerability
Go k8s.io/kubernetes · Upgrade to 1.28.4, 1.27.8, 1.26.11 or 1.25.16 by release line · >= 1.28.0, < 1.28.4; >= 1.27.0, < 1.27.8; >= 1.26.0, < 1.26.11; < 1.25.16 · CVE-2023-5528 · GHSA-hq6q-c2x6-hmch
- High, CVSS 7.6
Microsoft Security Advisory CVE-2023-36049: .NET Elevation of Privilege Vulnerability
NuGet system.net.requests · Upgrade to 8.0.0, 7.0.14 or 6.0.25 by release line · >= 8.0.0-rc.2.23480.2, <= 8.0.0-rc.2.23480.2; >= 6.0.0, <= 6.0.24; >= 7.0.0, <= 7.0.13 · CVE-2023-36049 · GHSA-c3hf-8vgx-72rh
- High, CVSS 7.1
Fabric vulnerable to crosslinking transaction attack
Go github.com/hyperledger/fabric · Upgrade to 2.5.5 or 2.2.14 by release line · >= 1.0.0-alpha, < 2.2.14; >= 2.3.0, < 2.5.5 · CVE-2023-46132 · GHSA-v9w2-543f-h69m
- High, CVSS 8.8
Guest Entries Remote code execution via file uploads
Packagist duncanmcclean/guest-entries +1 · Upgrade all 2 to 3.1.2 or later · < 3.1.2 · CVE-2023-47621 · GHSA-rw82-mhmx-grmj
- High, CVSS 7.5
Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task
PyPI label-studio · Upgrade to 1.9.2.post0 or later · < 1.9.2.post0 · CVE-2023-47117 · GHSA-6hjj-gq77-j4qw · amended
- High, CVSS 8.7
Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack
PyPI remarshal · Upgrade to 0.17.1 or later · < 0.17.1 · CVE-2023-47163 · GHSA-gw7g-qr8w-3448 · amended
- High, CVSS 8.3
Statamic CMS remote code execution via front-end form uploads
Packagist statamic/cms · Upgrade to 4.33.0 or 3.4.13 by release line · >= 4.0.0, < 4.33.0; < 3.4.13 · CVE-2023-47129 · GHSA-72hg-5wr5-rmfc
- Critical, CVSS 9.3
piccolo SQL Injection via named transaction savepoints
PyPI piccolo · Upgrade to 1.1.1 or later · < 1.1.1 · CVE-2023-47128 · GHSA-xq59-7jf3-rjc6 · amended
- High, CVSS 7.5
otelgrpc DoS vulnerability due to unbound cardinality metrics
Go go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc · Upgrade to 0.46.0 or later · >= 0.37.0, < 0.46.0 · CVE-2023-47108 · GHSA-8pgv-569h-w5rw
- High, CVSS 7.1
Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
PyPI apache-airflow · Upgrade to 2.7.3 or later · < 2.7.3 · CVE-2023-42781 · GHSA-r7x6-xfcm-3mxv · amended
- Critical, CVSS 9.9
Froxlor Improper Input Validation vulnerability
Packagist froxlor/froxlor · Upgrade to 2.1.0-beta1 (pre-release) or later · < 2.1.0-beta1 · CVE-2023-6069 · GHSA-4jch-8qq5-hqg6
- High, CVSS 7.5
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability
Go github.com/hashicorp/vault · Upgrade to 1.15.2, 1.14.6 or 1.13.10 by release line · < 1.13.10; >= 1.14.0, < 1.14.6; >= 1.15.0, < 1.15.2 · CVE-2023-5954 · GHSA-4qhc-v8r6-8vwm
- High, CVSS 8.8
Moodle Code Injection vulnerability
Packagist moodle/moodle · Upgrade to 4.3.0-rc2 (pre-release) or later · < 4.3.0-rc2 · CVE-2023-5540 · GHSA-w8x2-w4qr-v3x4
- High, CVSS 8.1
AsyncSSH Rogue Session Attack
PyPI asyncssh · Upgrade to 2.14.1 or later · < 2.14.1 · CVE-2023-46446 · GHSA-c35q-ffpf-5qpm · amended
- Critical, CVSS 9.8
Label Studio has Hardcoded Django
SECRET_KEYthat can be Abused to Forge Session TokensPyPI label-studio · Upgrade to 1.8.2 or later · < 1.8.2 · CVE-2023-43791 · GHSA-f475-x83m-rx5m · amended
- Critical, CVSS 9.3
PyArrow: Arbitrary code execution when loading a malicious data file
PyPI pyarrow · Upgrade to 14.0.1 or later · >= 0.14.0, < 14.0.1 · CVE-2023-47248 · GHSA-5wvp-7f3h-6wmm · amended
- High, CVSS 7.3
ZITADEL race condition in lockout policy execution
Go github.com/zitadel/zitadel · Upgrade to 2.40.5 or 2.38.3 by release line · >= 2.39.0, < 2.40.5; < 2.38.3 · CVE-2023-47111 · GHSA-7h8m-vrxx-vr4m
- Critical, CVSS 9.6
XWiki Platform vulnerable to reflected cross-site scripting through revision parameter in content menu
Maven org.xwiki.platform:xwiki-platform-flamingo-skin-resources · Upgrade to 15.5.1 or 14.10.14 by release line · >= 9.7-rc-1, < 14.10.14; >= 15.0-rc-1, < 15.5.1 · CVE-2023-46732 · GHSA-j9rc-w3wv-fv62
- Critical, CVSS 10.0
XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest
Maven org.xwiki.platform:xwiki-platform-administration-ui · Upgrade to 15.5.1 or 14.10.14 by release line · < 14.10.14; >= 15.0-rc-1, < 15.5.1 · +1 more package · CVE-2023-46731 · GHSA-62pr-qqf7-hh89
- High, CVSS 8.8
Apache UIMA Java SDK Deserialization of Untrusted Data, Improper Input Validation vulnerability
Maven org.apache.uima:uimaj · Upgrade to 3.5.0 or later · < 3.5.0 · CVE-2023-39913 · GHSA-5r8j-qmcm-7g7q
- Critical, CVSS 9.1
XWiki Platform privilege escalation from script right to programming right through title displayer
Maven org.xwiki.platform:xwiki-platform-display-api · Upgrade to 15.2-rc-1 (pre-release) or 14.10.7 by release line · >= 3.2-milestone-3, < 14.10.7; >= 15.0, < 15.2-rc-1 · CVE-2023-46244 · GHSA-rmxw-c48h-2vf5
- High, CVSS 8.8
XWiki Platform vulnerable to privilege escalation and remote code execution via the edit action
Maven org.xwiki.platform:xwiki-platform-oldcore · Upgrade to 15.2-rc-1 (pre-release) or 14.10.6 by release line · >= 15.0, < 15.2-rc-1; >= 1.0, < 14.10.6 · CVE-2023-46243 · GHSA-g2qq-c5j9-5w5w
- Critical, CVSS 9.6
XWiki Platform vulnerable to remote code execution via the edit action because it lacks CSRF token
Maven org.xwiki.platform:xwiki-platform-oldcore · Upgrade to 15.2-rc-1 (pre-release) or 14.10.7 by release line · >= 1.0, < 14.10.7; >= 15.0, < 15.2-rc-1 · CVE-2023-46242 · GHSA-hgpw-6p4h-j6h5
- High, CVSS 7.5
Calico Typha denial of service vulnerability
Go github.com/projectcalico/calico · Upgrade to 3.26.3; some affected versions have no fix yet · >= 3.26.0, < 3.26.3; <= 3.25.1 · CVE-2023-41378 · GHSA-5r5h-q934-cccp
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.