High, CVSS 7.5
Netmaker has Hardcoded DNS Secret Key
Go github.com/gravitl/netmaker · Upgrade to 0.18.6 or 0.17.1 by release line · < 0.17.1; >= 0.18.0, < 0.18.6 · CVE-2023-32077 · GHSA-8x8h-hcq8-jwwx
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
webpki: CPU denial of service in certificate path building
crates.io webpki · Upgrade to 0.22.2 or later · <= 0.22.1 · GHSA-8qv2-5vq6-g2g7
- High, CVSS 7.5
libp2p nodes vulnerable to OOM attack
Go github.com/libp2p/go-libp2p · Upgrade to 0.27.4 or later · <= 0.27.3 · CVE-2023-40583 · GHSA-gcq9-qqwx-rgj3
- High, CVSS 7.8
Spring-Kafka has Java Deserialization vulnerability When Improperly Configured
Maven org.springframework.kafka:spring-kafka · Upgrade to 3.0.10 or 2.9.11 by release line · >= 3.0.0, < 3.0.10; >= 2.8.1, < 2.9.11 · CVE-2023-34040 · GHSA-crqf-q9fp-hwjw
- High, CVSS 8.0
XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action
Maven org.xwiki.platform:xwiki-platform-oldcore · Upgrade to 15.4-rc-1 (pre-release) or 14.10.9 by release line · >= 3.2-milestone-3, < 14.10.9; >= 15.0-rc-1, < 15.4-rc-1 · CVE-2023-40572 · GHSA-4f8m-7h83-9f6m
- High, CVSS 7.2
Apache Airflow denial of service vulnerability
PyPI apache-airflow · Upgrade to 2.7.0b1 (pre-release) or later · < 2.7.0b1 · CVE-2023-37379 · GHSA-x2mh-8fmc-rqgh · amended
- High, CVSS 8.6
Apache Airflow Session Fixation vulnerability
PyPI apache-airflow · Upgrade to 2.7.0rc2 (pre-release) or later · < 2.7.0rc2 · CVE-2023-40273 · GHSA-pm87-24wq-r8w9 · amended
- High, CVSS 7.1
Argo CD web terminal session doesn't expire
Go github.com/argoproj/argo-cd/v2 · Upgrade to 2.8.1, 2.7.12, 2.6.14 or 2.0.0-20230821201509-e047efa8f951 (pre-release) by release line · >= 2.6.0, < 2.6.14; >= 2.7.0, < 2.7.12; >= 2.8.0, <= 2.8.0; >= 2.0.0-20230718200744-12a5a7a70d6e, < 2.0.0-20230821201509-e047efa8f951 · CVE-2023-40025 · GHSA-c8xw-vjgf-94hr
- High, CVSS 8.7
json2xml Uncaught Exception vulnerability
PyPI json2xml · Upgrade to 3.14.0 or later · < 3.14.0 · CVE-2022-25024 · GHSA-8rj5-2857-877j · amended
- Critical, CVSS 9.3
langchain vulnerable to arbitrary code execution
PyPI langchain · Upgrade to 0.0.312 or later · < 0.0.312 · CVE-2023-36281 · GHSA-7gfq-f96f-g85j · amended
- High, CVSS 7.1
Apache XML Graphics Batik Server-Side Request Forgery vulnerability
Maven org.apache.xmlgraphics:batik-bridge +2 · Upgrade all 3 to 1.17 or later · >= 1.0, < 1.17 · CVE-2022-44729 · GHSA-gq5f-xv48-2365
- High, CVSS 7.5
rustls-webpki: CPU denial of service in certificate path building
crates.io rustls-webpki · Upgrade to 0.101.4 or 0.100.2 by release line · < 0.100.2; >= 0.101.0, < 0.101.4 · GHSA-fh2r-99q2-6mmg
- High, CVSS 7.5
Weaviate denial of service vulnerability
Go github.com/weaviate/weaviate · Upgrade to 1.20.6, 1.19.13 or 1.18.6 by release line · >= 1.20.0, < 1.20.6; >= 1.19.0, < 1.19.13; < 1.18.6 · CVE-2023-38976 · GHSA-8697-479h-5mfp
- High, CVSS 8.6
Shescape on Windows escaping may be bypassed in threaded context
npm shescape · Upgrade to 1.7.4 or later · < 1.7.4 · CVE-2023-40185 · GHSA-j55r-787p-m549 · amended
- Critical, CVSS 9.9
XWiki Platform privilege escalation (PR) from account through AWM content fields
Maven org.xwiki.platform:xwiki-platform-appwithinminutes-ui · Upgrade to 14.10.5 or later · >= 4.3-milestone-2, < 14.10.5 · CVE-2023-40177 · GHSA-5mf8-v43w-mfxp
- High, CVSS 7.2
Craft CMS vulnerable to Remote Code Execution via validatePath bypass
Packagist craftcms/cms · Upgrade to 4.4.15 or 3.8.15 by release line · >= 4.0.0-RC1, <= 4.4.14; >= 3.0.0, <= 3.8.14 · CVE-2023-40035 · GHSA-44wr-rmwq-3phw
- High, CVSS 8.8
Apache Ivy External Entity Reference vulnerability
Maven org.apache.ivy:ivy · Upgrade to 2.5.2 or later · < 2.5.2 · CVE-2022-46751 · GHSA-2jc4-r94c-rp7h
- Critical, CVSS 9.9
XWiki Platform privilege escalation (PR)/RCE from account through Invitation subject/message
Maven org.xwiki.platform:xwiki-platform-invitation-ui · Upgrade to 15.2-rc-1 (pre-release), 14.10.6 or 14.4.8 by release line · >= 2.5-m-1, < 14.4.8; >= 14.5, < 14.10.6; >= 15.0-rc-1, < 15.2-rc-1 · CVE-2023-37914 · GHSA-7954-6m9q-gpvf
- Critical, CVSS 9.8
Puma HTTP Request/Response Smuggling vulnerability
RubyGems puma · Upgrade to 6.3.1 or 5.6.7 by release line · < 5.6.7; >= 6.0.0, < 6.3.1 · CVE-2023-40175 · GHSA-68xg-gqqm-vgj8
- High, CVSS 7.1
OpenNMS vulnerable to remote code execution
Maven org.opennms:opennms-base-assembly · Upgrade to 32.0.2 or later · < 32.0.2 · CVE-2023-40313 · GHSA-5m5f-qg8r-p9qf
- High, CVSS 7.5
Apache Airflow Spark Provider Improper Input Validation vulnerability
PyPI apache-airflow-providers-apache-spark · Upgrade to 4.1.3 or later · < 4.1.3 · CVE-2023-40272 · GHSA-r2f6-6928-fh8f · amended
- Critical, CVSS 9.8
tree-kit Prototype Pollution vulnerability
npm tree-kit · Upgrade to 0.7.5 or later · < 0.7.5 · CVE-2023-38894 · GHSA-5p42-m6f3-hpmj · amended
- High, CVSS 7.1
Flarum vulnerable to LFI and Blind SSRF via Avatar upload
Packagist flarum/framework +1 · Upgrade all 2 to 1.8.0 or later · < 1.8.0 · CVE-2023-40033 · GHSA-67c6-q4j4-hccg
- High, CVSS 8.1
Woodpecker does not validate webhook before changing any data
Go github.com/woodpecker-ci/woodpecker · Upgrade to 1.0.2 or later · >= 1.0.0, < 1.0.2 · CVE-2023-40034 · GHSA-4gcf-5m39-98mc
- High, CVSS 8.0
Jenkins Shortcut Job Plugin stored cross-site scripting vulnerability
Maven io.jenkins.plugins:shortcut-job · Upgrade to 0.5 or later · < 0.5 · CVE-2023-40346 · GHSA-jg35-vf67-gg2j
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.