High, CVSS 7.5
Parse Server may crash when uploading file without extension
npm parse-server · Upgrade to 6.3.1 or 5.5.6 by release line · >= 1.0.0, < 5.5.6; >= 6.0.0, < 6.3.1 · CVE-2023-46119 · GHSA-792q-q67h-w579 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
free5GC udm vulnerable to Invalid Curve Attack
Go github.com/free5gc/udm · Upgrade to 1.2.0 or later · < 1.2.0 · CVE-2023-46324 · GHSA-cqvv-r3g3-26rf
- High, CVSS 7.5
Langchain Server-Side Request Forgery vulnerability
PyPI langchain · Upgrade to 0.0.329 or later · < 0.0.329 · CVE-2023-32786 · GHSA-6h8p-4hx9-w66c · amended
- Critical, CVSS 9.8
Langchain SQL Injection vulnerability
PyPI langchain · Upgrade to 0.0.247 or later · < 0.0.247 · CVE-2023-32785 · GHSA-8h5w-f6q9-wg35 · amended
- Critical, CVSS 9.3
modoboa Cross-site Scripting vulnerability
PyPI modoboa · Upgrade to 2.2.2 or later · < 2.2.2 · CVE-2023-5688 · GHSA-pqgm-9g82-wcm7 · amended
- High, CVSS 7.5
modoboa Cross-site Scripting vulnerability
PyPI modoboa · Upgrade to 2.2.2 or later · < 2.2.2 · CVE-2023-5689 · GHSA-9wj3-cfq8-wpvj · amended
- High, CVSS 8.4
Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables
npm @tauri-apps/cli +1 · Upgrade all 2 to 2.0.0-alpha.16 (pre-release) or 1.5.6 by release line · >= 2.0.0-alpha.0, < 2.0.0-alpha.16; >= 1.0.0, < 1.5.6 · CVE-2023-46115 · GHSA-2rcp-jvr4-r259 · amended
- High, CVSS 7.5
Directus crashes on invalid WebSocket message
npm directus · Upgrade to 10.6.2 or later · >= 10.4.0, < 10.6.2 · CVE-2023-45820 · GHSA-hmgw-9jrg-hf2m · amended
- Critical, CVSS 9.1
Yamcs API Directory Traversal vulnerability
Maven org.yamcs:yamcs · Upgrade to 5.8.7 or later · < 5.8.7 · CVE-2023-45278 · GHSA-43fw-536j-w37j
- High, CVSS 7.5
Yamcs Path Traversal vulnerability
Maven org.yamcs:yamcs · Upgrade to 5.8.7 or later · < 5.8.7 · CVE-2023-45277 · GHSA-w4m2-qmh3-2g8f
- High, CVSS 7.5
Artifact Hub arbitrary file read vulnerability
Go github.com/artifacthub/hub · Upgrade to 1.16.0 or later · < 1.16.0 · CVE-2023-45823 · GHSA-hmq4-c2r4-5q8h
- High, CVSS 7.4
Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context
PyPI archivebox · Upgrade to 0.9.0 or later · < 0.9.0 · CVE-2023-45815 · GHSA-cr45-98w9-gwqx · amended
- High, CVSS 7.5
Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions
crates.io apollo-router · Upgrade to 1.33.0 or later · >= 1.31.0, < 1.33.0 · CVE-2023-45812 · GHSA-r344-xw3p-2frj
- High, CVSS 7.5
Apache InLong Deserialization of Untrusted Data Vulnerability
Maven org.apache.inlong:manager-pojo +1 · Upgrade all 2 to 1.9.0 or later · >= 1.4.0, < 1.9.0 · CVE-2023-46227 · GHSA-jj32-3pf5-5mv5
- High, CVSS 8.6
LangChain Server Side Request Forgery vulnerability
PyPI langchain · Upgrade to 0.0.317 or later · < 0.0.317 · CVE-2023-46229 · GHSA-655w-fm8m-m478 · amended
- High, CVSS 7.8
Synchrony deobfuscator prototype pollution vulnerability leading to arbitrary code execution
npm deobfuscator · Upgrade to 2.4.4 or later · >= 2.0.1, < 2.4.4 · CVE-2023-45811 · GHSA-jg82-xh3w-rhxx · amended
- High, CVSS 7.5
OpenFGA DoS vulnerability
Go github.com/openfga/openfga · Upgrade to 1.3.4 or later · < 1.3.4 · CVE-2023-45810 · GHSA-hr4f-6jh8-f2vq
- High, CVSS 7.3
Arduino Create Agent path traversal - local privilege escalation vulnerability
Go github.com/arduino/arduino-create-agent · Upgrade to 1.3.3 or later · < 1.3.3 · CVE-2023-43802 · GHSA-75j7-w798-cwwx
- High, CVSS 7.3
Arduino Create Agent Insufficient Verification of Data Authenticity vulnerability
Go github.com/arduino/arduino-create-agent · Upgrade to 1.3.3 or later · < 1.3.3 · CVE-2023-43800 · GHSA-4x5q-q7wc-q22p
- High, CVSS 7.5
OpenSearch uncontrolled resource consumption
Maven org.opensearch.plugin:opensearch-security · Upgrade to 2.11.0.0 or 1.3.14.0 by release line · < 1.3.14.0; >= 2.0.0.0, < 2.11.0.0 · GHSA-8wx3-324g-w4qq
- Critical, CVSS 10.0
Prototype Pollution in ali-security/mongoose
npm @seal-security/mongoose-fixed · Upgrade to 5.3.4 or later · >= 5.3.3, <= 5.3.3 · GHSA-rc4v-99cr-pjcm · amended
- High, CVSS 7.1
Cross-site Scripting via missing Binding syntax validation
Go github.com/crewjam/saml · Upgrade to 0.4.14 or later · < 0.4.14 · CVE-2023-45683 · GHSA-267v-3v32-g6q5
- High, CVSS 7.5
Silverstripe GraphQL has DDOS Vulnerability due to lack of protection against recursive queries
Packagist silverstripe/graphql · Upgrade to 5.0.3, 4.3.4, 4.2.5 or 2 more by release line · >= 3.0.0, < 3.8.2; >= 4.0.0, < 4.1.3; >= 4.2.0, < 4.2.5; >= 4.3.0, < 4.3.4; >= 5.0.0, < 5.0.3 · CVE-2023-40180 · GHSA-v23w-pppm-jh66
- Critical, CVSS 10.0
XWiki Identity Oauth Privilege escalation (PR)/remote code execution from login screen through unescaped URL parameter
Maven com.xwiki.identity-oauth:identity-oauth-ui · Upgrade to 1.6 or later · >= 1.0, < 1.6 · CVE-2023-45144 · GHSA-h2rm-29ch-wfmh
- High, CVSS 7.5
github.com/kumahq/kuma affected by CVE-2023-44487
Go github.com/kumahq/kuma · Upgrade to 2.4.3, 2.3.3, 2.2.4 or 2 more by release line · >= 2.4.0, < 2.4.3; >= 2.3.0, < 2.3.3; >= 2.2.0, < 2.2.4; >= 2.1.0, < 2.1.8; < 2.0.8 · GHSA-9wmc-rg4h-28wv
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.