High, CVSS 7.2
Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
Go k8s.io/ingress-nginx · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2023-5044 · GHSA-fp9f-44c2-cw27
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.6
Ingress nginx annotation injection causes arbitrary command execution
Go k8s.io/ingress-nginx · Upgrade to 1.9.0 or later · < 1.9.0 · CVE-2023-5043 · GHSA-5wj4-wffq-3378
- High, CVSS 8.8
Ingress-nginx path sanitization can be bypassed
Go k8s.io/ingress-nginx · Upgrade to 1.8.0 or later · < 1.8.0 · CVE-2022-4886 · GHSA-gvrm-w2f9-f77q
- High, CVSS 7.5
gRPC-Go HTTP/2 Rapid Reset vulnerability
Go google.golang.org/grpc · Upgrade to 1.58.3, 1.57.1 or 1.56.3 by release line · < 1.56.3; >= 1.57.0, < 1.57.1; >= 1.58.0, < 1.58.3 · GHSA-m425-mq94-257g
- Critical, CVSS 9.1
crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
npm crypto-js · Upgrade to 4.2.0 or later · < 4.2.0 · CVE-2023-46233 · GHSA-xwcq-pm8m-c4vf · amended
- Critical, CVSS 9.1
crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
npm crypto-es · Upgrade to 2.1.0 or later · < 2.1.0 · CVE-2023-46133 · GHSA-mpj8-q39x-wq5h · amended
- Critical, CVSS 9.0
XWiki Platform vulnerable to XSS with edit right in the create document form for existing pages
Maven org.xwiki.platform:xwiki-platform-web · Upgrade to 13.4-rc-1 (pre-release) or later · >= 3.1-milestone-2, < 13.4-rc-1 · +1 more package · CVE-2023-45137 · GHSA-93gh-jgjj-r929
- Critical, CVSS 9.6
XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled
Maven org.xwiki.platform:xwiki-platform-web-templates · Upgrade to 15.5-rc-1 (pre-release) or 14.10.12 by release line · >= 12.0-rc-1, < 14.10.12; >= 15.0-rc-1, < 15.5-rc-1 · CVE-2023-45136 · GHSA-qcj9-gcpg-4w2w
- Critical, CVSS 9.0
XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
Maven org.xwiki.platform:xwiki-platform-web · Upgrade to 14.10.12 or later · >= 7.2-milestone-2, < 14.10.12 · +1 more package · CVE-2023-45135 · GHSA-ghf6-2f42-mjh9
- Critical, CVSS 9.0
XWiki Platform XSS vulnerability from account in the create page form via template provider
Maven org.xwiki.platform:xwiki-platform-web · Upgrade to 13.4-rc-1 (pre-release) or later · >= 3.1-milestone-1, < 13.4-rc-1 · +2 more packages · CVE-2023-45134 · GHSA-gr82-8fj2-ggc3
- Critical, CVSS 9.9
org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter
Maven org.xwiki.platform:xwiki-platform-office-importer · Upgrade to 15.3-rc-1 (pre-release) or 14.10.8 by release line · >= 3.5-milestone-1, < 14.10.8; >= 15.0-rc-1, < 15.3-rc-1 · CVE-2023-37913 · GHSA-vcvr-v426-3m3m
- High, CVSS 8.8
XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro
Maven org.xwiki.rendering:xwiki-rendering-macro-footnotes · Upgrade to 15.1-rc-1 (pre-release) or 14.10.6 by release line · < 14.10.6; >= 15.0-rc-1, < 15.1-rc-1 · +1 more package · CVE-2023-37912 · GHSA-35j5-m29r-xfq5
- High, CVSS 8.1
org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move
Maven org.xwiki.platform:xwiki-platform-attachment-api · Upgrade to 14.10.4 or 14.4.8 by release line · >= 14.0-rc-1, < 14.4.8; >= 14.5, < 14.10.4 · CVE-2023-37910 · GHSA-rwwx-6572-mp29
- High, CVSS 8.8
Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet
Maven org.xwiki.platform:xwiki-platform-menu-ui · Upgrade to 15.3-rc-1 (pre-release) or 14.10.8 by release line · >= 5.1-rc-1, < 14.10.8; >= 15.0-rc-1, < 15.3-rc-1 · +1 more package · CVE-2023-37909 · GHSA-v2rr-xw95-wcjx
- Critical, CVSS 9.6
org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
Maven org.xwiki.rendering:xwiki-rendering-xml · Upgrade to 14.10.4 or later · >= 14.6-rc-1, < 14.10.4 · CVE-2023-37908 · GHSA-663w-2xp3-5739
- High, CVSS 8.0
Stored XSS vulnerability in Jenkins GitHub Plugin
Maven com.coravy.hudson.plugins.github:github · Upgrade to 1.37.3.1 or later · < 1.37.3.1 · CVE-2023-46650 · GHSA-mv77-fj63-q5w8
- High, CVSS 8.0
Jenkins CloudBees CD Plugin vulnerable to arbitrary file deletion
Maven org.jenkins-ci.plugins:electricflow · Upgrade to 1.1.33 or later · < 1.1.33 · CVE-2023-46654 · GHSA-jx7x-rf3f-j644
- Critical, CVSS 9.3
SaToken privilege escalation vulnerability
Maven cn.dev33:sa-token-core · Upgrade to 1.37.0 or later · < 1.37.0 · CVE-2023-44794 · GHSA-54f6-9mx9-86f7
- High, CVSS 8.7
SaToken authentication bypass vulnerability
Maven cn.dev33:sa-token-core · Upgrade to 1.36.0 or later · < 1.36.0 · CVE-2023-43961 · GHSA-w9vh-hv5g-7wmr
- Critical, CVSS 9.8
Sureness uses hardcoded key
Maven com.usthe.sureness:sureness-core · Upgrade to 1.0.8 or later · < 1.0.8 · CVE-2023-31581 · GHSA-3j2f-58rq-g6p7
- High, CVSS 7.5
jose4j uses weak cryptographic algorithm
Maven org.bitbucket.b_c:jose4j · Upgrade to 0.9.3 or later · < 0.9.3 · CVE-2023-31582 · GHSA-7g24-qg88-p43q
- High, CVSS 8.3
Nautobot vulnerable to exposure of hashed user passwords via REST API
PyPI nautobot · Upgrade to 2.0.3 or later · >= 2.0.0, < 2.0.3 · CVE-2023-46128 · GHSA-r2hw-74xv-4gqp · amended
- High, CVSS 8.6
WPS Server Side Request Forgery vulnerability
Maven org.geoserver.extension:gs-wps-core · Upgrade to 2.23.2 or 2.22.5 by release line · < 2.22.5; >= 2.23.0, < 2.23.2 · CVE-2023-43795 · GHSA-5pr3-m5hm-9956
- High, CVSS 8.2
Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload
PyPI ethyca-fides · Upgrade to 2.22.1 or later · < 2.22.1 · CVE-2023-46124 · GHSA-jq3w-9mgf-43m4 · amended
- High, CVSS 7.5
encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs
RubyGems encoded_id-rails · Upgrade to 1.0.0.beta2 or later · < 1.0.0.beta2 · CVE-2024-0241 · GHSA-3px7-jm2p-6h2c
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.