High, CVSS 7.3
Prototype Pollution(PP) vulnerability in setByPath
npm @clickbar/dot-diver · Upgrade to 1.0.2 or later · < 1.0.2 · CVE-2023-45827 · GHSA-9w5f-mw3p-pj47 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.6
Unauthorized Access to Private Fields in User Registration API
npm @strapi/plugin-users-permissions +1 · Upgrade all 2 to 4.13.1 or later · >= 4.0.0, < 4.13.1 · CVE-2023-39345 · GHSA-gc7p-j5xm-xxh2 · amended
- High, CVSS 8.8
Kubernetes csi-proxy vulnerable to privilege escalation due to improper input validation
Go github.com/kubernetes-csi/csi-proxy · Upgrade to 1.1.3-0.20230821192013-2523e6674ded (pre-release), 1.1.3 or 0.0.0-20230821192013-2523e6674ded (pre-release) by release line · >= 0.1.0-rc1, <= 1.1.2; < 0.0.0-20230821192013-2523e6674ded; >= 1.1.3-0, < 1.1.3-0.20230821192013-2523e6674ded · +1 more package · CVE-2023-3893 · GHSA-r6cc-7wj7-gfx2
- High, CVSS 8.7
Django Denial-of-service in django.utils.text.Truncator
PyPI django · Upgrade to 4.2.6, 4.1.12 or 3.2.22 by release line · >= 3.2a1, < 3.2.22; >= 4.1a1, < 4.1.12; >= 4.2a1, < 4.2.6 · CVE-2023-43665 · GHSA-h8gc-pgj2-vjm3 · amended
- High, CVSS 8.7
Pillow Denial of Service vulnerability
PyPI pillow · Upgrade to 10.0.0 or later · < 10.0.0 · CVE-2023-44271 · GHSA-8ghj-p4vj-mr35 · amended
- High, CVSS 7.5
Dromara Lamp-Cloud Use of Hard-coded Cryptographic Key
Maven top.tangyh.basic:lamp-util +1 · Upgrade all 2 to 3.8.1 or later · < 3.8.1 · CVE-2023-31579 · GHSA-xr8c-mq5x-5f56
- High, CVSS 8.1
FoodCoopShop Server-Side Request Forgery vulnerability
Packagist foodcoopshop/foodcoopshop · Upgrade to 3.6.1 or later · >= 3.2.0, < 3.6.1 · CVE-2023-46725 · GHSA-jhww-fx2j-3rf7
- Critical, CVSS 9.3
transmute-core unsafe YAML deserialization vulnerability
PyPI transmute-core · Upgrade to 1.13.5 or later · < 1.13.5 · CVE-2023-47204 · GHSA-w9cp-3x79-2p8p · amended
- High, CVSS 8.7
Django potential denial of service vulnerability in UsernameField on Windows
PyPI django · Upgrade to 4.2.7, 4.1.13 or 3.2.23 by release line · >= 3.2a1, < 3.2.23; >= 4.1a1, < 4.1.13; >= 4.2a1, < 4.2.7 · CVE-2023-46695 · GHSA-qmf9-6jqf-j8fq · amended
- High, CVSS 7.5
Dolibarr Improper Input Validation vulnerability
Packagist dolibarr/dolibarr · Upgrade to 18.0.2 or later · < 18.0.2 · CVE-2023-4197 · GHSA-r9cm-pw9j-3fpx
- High, CVSS 8.8
Kubernetes privilege escalation vulnerability
Go k8s.io/kubernetes · Upgrade to 1.28.1, 1.27.5, 1.26.8 or 2 more by release line · >= 1.28.0, <= 1.28.0; >= 1.27.0, < 1.27.5; >= 1.26.0, < 1.26.8; >= 1.25.0, < 1.25.13; < 1.24.17 · CVE-2023-3955 · GHSA-q78c-gwqw-jcmc
- High, CVSS 8.8
Kubernetes privilege escalation vulnerability
Go k8s.io/kubernetes · Upgrade to 1.28.1, 1.27.5, 1.26.8 or 2 more by release line · >= 1.28.0, <= 1.28.0; >= 1.27.0, < 1.27.5; >= 1.26.0, < 1.26.8; >= 1.25.0, < 1.25.13; < 1.24.17 · CVE-2023-3676 · GHSA-7fxm-f474-hf8w
- High, CVSS 7.5
xkeys seal encryption used fixed key for all encryption
Go github.com/nats-io/nkeys · Upgrade to 0.4.6 or later · >= 0.4.0, <= 0.4.5 · +1 more package · CVE-2023-46129 · GHSA-mr45-rx8q-wcm9
- High, CVSS 7.6
Insufficient Session Expiration in thorsten/phpmyfaq
Packagist thorsten/phpmyfaq · Upgrade to 3.2.2 or later · < 3.2.2 · CVE-2023-5865 · GHSA-f728-prhw-2g68
- High, CVSS 7.4
phpMyFAQ Cross-site Scripting vulnerability
Packagist thorsten/phpmyfaq · Upgrade to 3.2.1 or later · < 3.2.1 · CVE-2023-5864 · GHSA-g5hp-328h-jj98
- High, CVSS 7.5
generator-jhipster allows a timing attack against validateToken due to a string comparison that stops at the first character
npm generator-jhipster · Upgrade to 2.23.0 or later · < 2.23.0 · CVE-2015-20110 · GHSA-4gpm-r23h-gprw · amended
- Critical, CVSS 9.8
OpenCRX allows a remote attacker to execute arbitrary code via a crafted request
Maven org.opencrx:opencrx-client · Upgrade to 5.3.0 or later · < 5.3.0 · CVE-2023-46502 · GHSA-q74f-rf27-8hxc
- High, CVSS 7.2
Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
Packagist kimai/kimai · Upgrade to 2.1.0 or later · < 2.1.0 · CVE-2023-46245 · GHSA-fjhg-96cp-6fcw
- High, CVSS 7.5
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
Packagist codeigniter4/framework · Upgrade to 4.4.3 or later · <= 4.4.2 · CVE-2023-46240 · GHSA-hwxf-qxj7-7rfj
- High, CVSS 7.5
quic-go vulnerable to pointer dereference that can lead to panic
Go github.com/quic-go/quic-go · Upgrade to 0.37.3 or later · >= 0.37.0, < 0.37.3 · CVE-2023-46239 · GHSA-3q6m-v84f-6p9h
- High, CVSS 7.5
Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability
PyPI apache-airflow-providers-celery · Upgrade to 3.4.1 or later · >= 3.3.0, < 3.4.1 · +1 more package · CVE-2023-46215 · GHSA-666g-rfc5-c9jv · amended
- High, CVSS 7.5
DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998
Maven org.owasp.esapi:esapi · Upgrade to 2.5.2.0 or later · < 2.5.2.0 · GHSA-7c2q-5qmr-v76q
- Critical, CVSS 10.0Exploited · CISA KEV
Apache ActiveMQ is vulnerable to Remote Code Execution
Maven org.apache.activemq:activemq-client +1 · Upgrade all 2 to 5.18.3, 5.17.6, 5.16.7 or 5.15.16 by release line · < 5.15.16; >= 5.16.0, < 5.16.7; >= 5.17.0, < 5.17.6; >= 5.18.0, < 5.18.3 · CVE-2023-46604 · GHSA-crg9-44h2-xw35
- High, CVSS 7.5
browserify-sign upper bound check issue in
dsaVerifyleads to a signature forgery attacknpm browserify-sign · Upgrade to 4.2.2 or later · >= 2.6.0, <= 4.2.1 · CVE-2023-46234 · GHSA-x9w5-v3q2-3rhw · amended
- High, CVSS 7.5
Elasticsearch vulnerable to Uncontrolled Resource Consumption
Maven org.elasticsearch:elasticsearch · Upgrade to 8.9.0 or 7.17.13 by release line · < 7.17.13; >= 8.0.0, < 8.9.0 · CVE-2023-31418 · GHSA-2cqf-6xv9-f22w
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.