High, CVSS 7.5
lol-html panics on certain HTML inputs
crates.io lol-html · Upgrade to 1.1.1 or later · < 1.1.1 · CVE-2023-4241 · GHSA-c3x7-354f-4p2x
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.8
.NET Remote Code Execution Vulnerability
NuGet microsoft.net.build.containers · Upgrade to 7.0.307 or later · <= 7.0.306 · CVE-2023-35390 · GHSA-p8rx-fwgq-rh2f
- High, CVSS 7.5
.NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +7 · Upgrade all 8 to 7.0.10 or later · >= 7.0.0, <= 7.0.9 · CVE-2023-38178 · GHSA-p57v-gv7q-4xfm
- High, CVSS 7.5Exploited · CISA KEV
.NET Denial of Service Vulnerability
NuGet microsoft.aspnetcore.app.runtime.win-x86 · Upgrade to 7.0.10 or 6.0.21 by release line · >= 7.0.0, <= 7.0.9; >= 6.0.0, <= 6.0.20 · +4 more packages · CVE-2023-38180 · GHSA-vmch-3w2x-vhgq
- High, CVSS 8.1
Privilege escalation via ApiTokensEndpoint
PyPI sentry · Upgrade to 23.7.2 or later · >= 22.1.0, < 23.7.2 · CVE-2023-39349 · GHSA-9jcq-jf57-c62c · amended
- High, CVSS 8.1
import-in-the-middle has unsanitized user controlled input in module generation
npm import-in-the-middle · Upgrade to 1.4.2 or later · <= 1.4.1 · CVE-2023-38704 · GHSA-5r27-rw8r-7967 · amended
- High, CVSS 8.6
Denial of service in jackson-dataformat-toml
Maven com.fasterxml.jackson.dataformat:jackson-dataformat-toml · Upgrade to 2.15.0 or later · < 2.15.0 · CVE-2023-3894 · GHSA-rg2c-cfxv-qp6f
- Critical, CVSS 9.9
Cockpit PHP Remote File Inclusion vulnerability
Packagist cockpit-hq/cockpit · Upgrade to 2.6.3 or later · < 2.6.3 · CVE-2023-4195 · GHSA-xcq3-7pf3-5jvc
- High, CVSS 8.3
Cockpit Cross-site Scripting vulnerability
Packagist cockpit-hq/cockpit · Upgrade to 2.6.3 or later · < 2.6.3 · CVE-2023-4196 · GHSA-w3qm-93vf-5hrw
- High, CVSS 8.7
Apache Airflow Execution with Unnecessary Privileges
PyPI apache-airflow · Upgrade to 2.6.0b1 (pre-release) or later · < 2.6.0b1 · CVE-2023-39508 · GHSA-269x-pg5c-5xgm · amended
- Critical, CVSS 9.3
langchain Code Injection vulnerability
PyPI langchain · Upgrade to 0.0.236 or later · < 0.0.236 · CVE-2023-36095 · GHSA-gwqq-6vq7-5j86 · amended
- High, CVSS 7.5
Nuclei Path Traversal vulnerability
Go github.com/projectdiscovery/nuclei +1 · Upgrade all 2 to 2.9.9 or later · < 2.9.9 · CVE-2023-37896 · GHSA-2xx4-jj5v-6mff
- Critical, CVSS 9.8
Aerospike Java Client vulnerable to unsafe deserialization of server responses
Maven com.aerospike:aerospike-client · Upgrade to 6.2.0, 5.2.0 or 4.5.0 by release line · >= 6.0.0, < 6.2.0; >= 5.0.0, < 5.2.0; < 4.5.0 · CVE-2023-36480 · GHSA-jj95-55cr-9597
- Critical, CVSS 9.8
Soketi was exposed to Sandbox Escape vulnerability via vm2
npm @soketi/soketi · Upgrade to 1.6.0 or later · < 1.6.0 · GHSA-g6w6-h933-4rc5 · amended
- High, CVSS 7.4
Cross-site Scripting (XSS) in CrafterCMS
Maven org.craftercms:crafter-engine · Upgrade to 4.0.3 or 3.1.28 by release line · >= 4.0.0, < 4.0.3; >= 3.1.0, < 3.1.28 · CVE-2023-4136 · GHSA-jfm4-3vv3-fm4v
- High, CVSS 7.9
Cargo not respecting umask when extracting crate archives
crates.io cargo · Upgrade to 0.72.2 or later · <= 0.72.1 · CVE-2023-38497 · GHSA-j3xp-wfr4-hx87
- High, CVSS 8.1
Answer Missing Authorization vulnerability
Go github.com/answerdev/answer · Upgrade to 1.1.1 or later · < 1.1.1 · CVE-2023-4124 · GHSA-v9vc-7x69-c2x8
- High, CVSS 8.8
Answer has Weak Password Requirements
Go github.com/answerdev/answer · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2023-4125 · GHSA-j63x-f657-2m9g
- High, CVSS 7.5
Keylime's registrar vulnerable to Denial-of-service attack via a single open connection
PyPI keylime · Upgrade to 7.4.0 or later · < 7.4.0 · CVE-2023-38200 · GHSA-pg75-v6fp-8q59 · amended
- Critical, CVSS 9.1
MindsDB can be made to not verify SSL certificates
PyPI mindsdb · Upgrade to 23.7.4.0 or later · < 23.7.4.0 · CVE-2023-38699 · GHSA-8hx6-qv6f-xgcw · amended
- High, CVSS 7.5
pnpm incorrectly parses tar archives relative to specification
npm pnpm · Upgrade to 8.6.8 or 7.33.4 by release line · < 7.33.4; >= 8.0.0, < 8.6.8 · +8 more packages · CVE-2023-37478 · GHSA-5r98-f33j-g8h7 · amended
- Critical, CVSS 9.8
RaspAP Command Injection vulnerability
Packagist billz/raspap-webgui · Upgrade to 2.8.8 or later · >= 2.8.0, < 2.8.8 · CVE-2022-39986 · GHSA-7c28-wg7r-pg6f
- High, CVSS 8.8
RaspAP Command Injection vulnerability
Packagist billz/raspap-webgui · Upgrade to 2.9.5 or later · >= 2.8.0, < 2.9.5 · CVE-2022-39987 · GHSA-7r88-wjhj-jr8m
- High, CVSS 8.8
mlflow vulnerable to OS Command Injection
PyPI mlflow · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2023-4033 · GHSA-ffw3-6378-cqgp · amended
- Critical, CVSS 9.3
Sydent does not verify email server certificates
PyPI matrix-sydent · Upgrade to 2.5.6 or later · < 2.5.6 · CVE-2023-38686 · GHSA-p6hw-wm59-3g5g · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.