High, CVSS 7.5
twitch-tui's connection is not encrypted
crates.io twitch-tui · Upgrade to 2.4.1 or later · < 2.4.1 · CVE-2023-38688 · GHSA-779w-xvpm-78jx
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability
Packagist thorsten/phpmyfaq · Upgrade to 3.1.16 or later · < 3.1.16 · CVE-2023-4006 · GHSA-2xvx-368h-qcmv
- High, CVSS 8.8
phpMyFAQ Stored Cross-site Scripting vulnerability
Packagist thorsten/phpmyfaq · Upgrade to 3.1.16 or later · < 3.1.16 · CVE-2023-4007 · GHSA-q9vm-29ph-p7mp
- High, CVSS 8.7
Apache NiFi Code Injection vulnerability
Maven org.apache.nifi:nifi-standard-processors +7 · Upgrade all 8 to 1.23.0 or later · >= 0.0.2, < 1.23.0 · CVE-2023-36542 · GHSA-r969-8v3h-23v9
- High, CVSS 7.1
Field injection in the KirbyData text storage handler
Packagist getkirby/cms · Upgrade to 3.9.6, 3.8.4.1, 3.7.5.2 or 2 more by release line · < 3.5.8.3; >= 3.6.0, < 3.6.6.3; >= 3.7.0, < 3.7.5.2; >= 3.8.0, < 3.8.4.1; >= 3.9.0, < 3.9.6 · CVE-2023-38488 · GHSA-x5mr-p6v4-wp93
- High, CVSS 7.3
Insufficient Session Expiration after a password change
Packagist getkirby/cms · Upgrade to 3.9.6, 3.8.4.1, 3.7.5.2 or 2 more by release line · < 3.5.8.3; >= 3.6.0, < 3.6.6.3; >= 3.7.0, < 3.7.5.2; >= 3.8.0, < 3.8.4.1; >= 3.9.0, < 3.9.6 · CVE-2023-38489 · GHSA-5mvj-rvp8-rf45
- High, CVSS 8.3
Possible image tampering from missing image validation for Packages
Go github.com/crossplane/crossplane · Upgrade to 1.12.3 or 1.11.5 by release line · < 1.11.5; >= 1.12.0, < 1.12.3 · CVE-2023-38495 · GHSA-pj4x-2xr5-w87m
- Critical, CVSS 9.6
Anyone with a share link can RESET all website data in Umami
npm umami · Upgrade to 2.3.1 or later · < 2.3.1 · GHSA-8www-cffh-4q98 · amended
- Critical, CVSS 9.8
SQL injection in jeecg-boot
Maven org.jeecgframework.boot:jeecg-boot-common · Upgrade to 3.5.3 or later · < 3.5.3 · CVE-2023-38992 · GHSA-wp6c-29r3-jqw9
- Critical, CVSS 9.3
Code injection in stanford-parser
Maven edu.stanford.nlp:stanford-parser · Upgrade to 4.5.5 or later · < 4.5.5 · CVE-2023-39020 · GHSA-353m-jh2m-72v4
- Critical, CVSS 9.8
Code injection in BoofCV
Maven org.boofcv:boofcv-core · Upgrade to 0.43.1 or later · < 0.43.1 · CVE-2023-39010 · GHSA-99p5-qpqx-mhwc
- High, CVSS 8.7
Unsafe plugins can be installed via pack import by tenant admins
npm @saltcorn/cli · Upgrade to 0.8.8-beta.2 (pre-release) or later · < 0.8.8-beta.2 · GHSA-wxf3-4fvj-vqqx · amended
- High, CVSS 7.5
DoS vulnerability for apps with sockets enabled
npm sails · Upgrade to 1.5.7 or later · < 1.5.7 · CVE-2023-38504 · GHSA-gpw9-fwm8-7rx7 · amended
- High, CVSS 7.7
Missing authorization in Jenkins Plug-in for ServiceNow
Maven io.jenkins.plugins:servicenow-devops · Upgrade to 1.38.1 or later · < 1.38.1 · CVE-2023-3442 · GHSA-cj2x-r74q-vcx9
- High, CVSS 8.0
Jenkins Stored Cross-site Scripting vulnerability
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.416, 2.414.1 or 2.401.3 by release line · < 2.401.3; >= 2.415, <= 2.415; >= 2.402, < 2.414.1 · CVE-2023-39151 · GHSA-69vw-3pcm-84rw
- Critical, CVSS 9.6
Command injection in PaddlePaddle
PyPI paddlepaddle · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2023-38673 · GHSA-9q9v-qgwx-84mr · amended
- High, CVSS 8.3
Heap buffer overflow in PaddlePaddle
PyPI paddlepaddle · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2023-38671 · GHSA-hh7p-hvm3-rg88 · amended
- High, CVSS 8.3
Use after free in PaddlePaddle
PyPI paddlepaddle · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2023-38669 · GHSA-8wfh-qxxv-3q8c · amended
- Critical, CVSS 9.3
Deserialization vulnerability in Helix workflow and REST
Maven org.apache.helix:helix-core +1 · Upgrade all 2 to 1.3.0 or later · < 1.3.0 · CVE-2023-38647 · GHSA-jhcr-hph9-g7wm
- High, CVSS 7.5
Paths contain matrix variables bypass decorators
Maven com.linecorp.armeria:armeria · Upgrade to 1.24.3 or later · <= 1.24.2 · CVE-2023-38493 · GHSA-wvp2-9ppw-337j
- High, CVSS 8.1
Arbitrary File Creation in AbstractUnArchiver
Maven org.codehaus.plexus:plexus-archiver · Upgrade to 4.8.0 or later · < 4.8.0 · CVE-2023-37460 · GHSA-wh3p-fphp-9h2m
- High, CVSS 8.3
Improper authorization on debug and artifact file downloads
PyPI sentry · Upgrade to 23.5.2 or later · >= 8.21.0, < 23.5.2 · CVE-2023-36826 · GHSA-m4hc-m2v6-hfw8 · amended
- High, CVSS 8.6
Leaking sensitive user information still possible by filtering on private with prefix fields
npm @strapi/utils +1 · Upgrade all 2 to 4.10.8 or later · <= 4.10.7 · CVE-2023-34235 · GHSA-9xg4-3qfm-9w8f · amended
- Critical, CVSS 9.8
Remote code execution in Apache Jackrabbit
Maven org.apache.jackrabbit:jackrabbit-standalone-components +2 · Upgrade all 3 to 2.21.18 or 2.20.11 by release line · >= 2.21.0, < 2.21.18; >= 1.0.0, < 2.20.11 · CVE-2023-37895 · GHSA-q8cm-3v62-jj79
- High, CVSS 7.5
Removal of e-Tugra root certificate
PyPI certifi · Upgrade to 2023.7.22 or later · >= 2015.4.28, < 2023.7.22 · CVE-2023-37920 · GHSA-xqr8-7jwr-rhp7 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.