High, CVSS 7.5
Remote Denial of Service Vulnerability in Microsoft.Native.Quic.MsQuic.Schannel
NuGet microsoft.native.quic.msquic.schannel +1 · Upgrade all 2 to 2.2.3 or later · < 2.2.3 · CVE-2023-38171 · GHSA-xh5m-8qqp-c5x7
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.4
OctoPrint vulnerable to Improper Neutralization of Special Elements Used in a Template Engine
PyPI octoprint · Upgrade to 1.9.3 or later · < 1.9.3 · CVE-2023-41047 · GHSA-fwfg-vprh-97ph · amended
- High, CVSS 7.5
HTTP/2 HPACK integer overflow and buffer allocation
Maven org.eclipse.jetty.http3:http3-qpack · Upgrade to 11.0.16 or 10.0.16 by release line · >= 10.0.0, <= 10.0.15; >= 11.0.0, <= 11.0.15 · +1 more package · CVE-2023-36478 · GHSA-wgh7-54f2-x98r
- High, CVSS 8.8
Azure Identity SDK Remote Code Execution Vulnerability
NuGet azure.identity · Upgrade to 1.10.2 or later · < 1.10.2 · CVE-2023-36414 · GHSA-5mfx-4wcx-rv27
- High, CVSS 7.5
github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset
Go github.com/nghttp2/nghttp2 · Upgrade to 1.57.0 or later · < 1.57.0 · GHSA-vx74-f528-fxqg
- High, CVSS 8.7
MediaWiki Denial of Service vulnerability
Packagist mediawiki/core · Upgrade to 1.40.1, 1.39.5 or 1.35.12 by release line · < 1.35.12; >= 1.36.0, < 1.39.5; >= 1.40.0, <= 1.40.0 · CVE-2023-45363 · GHSA-w5fx-cx7f-6vr9
- Critical, CVSS 9.8
Code injection in fsevents
npm fsevents · Upgrade to 1.2.11 or later · <= 1.2.10 · CVE-2023-45311 · GHSA-8r6j-v8pm-fqw3 · amended
- High, CVSS 8.8
ThingsBoard Server-Side Template Injection
Maven org.thingsboard:thingsboard · Upgrade to 3.5 or later · < 3.5 · CVE-2023-45303 · GHSA-6pgr-j9v4-xfvv
- Critical, CVSS 9.8
Puppet Bolt privilege escalation vulnerability
RubyGems bolt · Upgrade to 3.27.4 or later · < 3.27.4 · CVE-2023-5214 · GHSA-289m-2964-f8q5
- High, CVSS 8.8
Bundled libwebp in pywebp vulnerable
PyPI webp · Upgrade to 0.3.0 or later · < 0.3.0 · GHSA-f9pm-4g9p-6vm3 · amended
- Critical, CVSS 9.8
geokit-rails Command Injection vulnerability
RubyGems geokit-rails · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2023-26153 · GHSA-7xvc-v44j-46fh
- High, CVSS 8.8
NI MeasurementLink Python Services Improper Access Restriction vulnerability
PyPI ni-measurementlink-service · Upgrade to 1.2.0 or 1.1.1 by release line · < 1.1.1; >= 1.2.0.dev0, < 1.2.0 · CVE-2023-4570 · GHSA-3f48-9j7q-q2gv · amended
- High, CVSS 7.1
Decidim has broken access control in templates
RubyGems decidim +1 · Upgrade all 2 to 0.27.4 or 0.26.8 by release line · >= 0.23.2, < 0.26.8; >= 0.27.0, < 0.27.4 · CVE-2023-36465 · GHSA-639h-86hw-qcjq
- High, CVSS 7.5
Zod denial of service vulnerability during email validation
npm express-zod-api · Upgrade to 10.0.0-beta1 (pre-release) or later · < 10.0.0-beta1 · GHSA-mvrp-3cvx-c325 · amended
- High, CVSS 7.5
Quarkus OIDC can leak both ID and access tokens
Maven io.quarkus:quarkus-oidc · Upgrade to 3.1.0.Final or 2.13.0.Final by release line · < 2.13.0.Final; >= 3.0.0, < 3.1.0.Final · CVE-2023-1584 · GHSA-6hc9-cf8x-hf83
- High, CVSS 7.5
asyncua Improper Authentication vulnerability
PyPI asyncua · Upgrade to 0.9.96 or later · < 0.9.96 · CVE-2023-26150 · GHSA-2894-qcqf-g23g · amended
- High, CVSS 7.5
asyncua vulnerable to denial of service via infinite loop
PyPI asyncua · Upgrade to 0.9.96 or later · < 0.9.96 · CVE-2023-26151 · GHSA-gfvq-mxw3-mfq3 · amended
- High, CVSS 7.5
Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabled
Go github.com/charmbracelet/soft-serve · Upgrade to 0.6.2 or later · < 0.6.2 · CVE-2023-43809 · GHSA-mc97-99j4-vm2v
- High, CVSS 7.5
opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics
PyPI opentelemetry-instrumentation · Upgrade to 0.41b0 (pre-release) or later · < 0.41b0 · CVE-2023-43810 · GHSA-5rv5-6h4r-h22v · amended
- High, CVSS 7.4
CookieHTTP header isn't stripped on cross-origin redirectsPyPI urllib3 · Upgrade to 2.0.6 or 1.26.17 by release line · >= 2.0.0, < 2.0.6; < 1.26.17 · CVE-2023-43804 · GHSA-v845-jxx5-vc9f · amended
- Critical, CVSS 9.8
TorchServe Server-Side Request Forgery vulnerability
PyPI torchserve · Upgrade to 0.8.2 or later · >= 0.1.0, < 0.8.2 · CVE-2023-43654 · GHSA-8fxr-qfr9-p34w · amended
- Critical, CVSS 9.9
TorchServe Pre-Auth Remote Code Execution
PyPI torchserve · Upgrade to 0.8.2 or later · >= 0.3.0, < 0.8.2 · GHSA-4mqg-h5jf-j9m7 · amended
- Critical, CVSS 9.1
phpMyFAQ Cross-site Scripting vulnerability
Packagist thorsten/phpmyfaq · Upgrade to 3.1.18 or later · < 3.1.18 · CVE-2023-5316 · GHSA-58v7-58c2-qwm9
- High, CVSS 8.3
phpMyFAQ Cross-site Scripting vulnerability
Packagist thorsten/phpmyfaq · Upgrade to 3.1.18 or later · < 3.1.18 · CVE-2023-5319 · GHSA-j5ww-5xf4-hqm2
- Critical, CVSS 9.0
phpMyFAQ Cross-site Scripting vulnerability
Packagist thorsten/phpmyfaq · Upgrade to 3.1.18 or later · < 3.1.18 · CVE-2023-5320 · GHSA-pp4w-g5p4-85p2
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.