Critical, CVSS 10.0
Path traversal and code execution via prototype vulnerability
npm nodebb · Upgrade to 2.8.7 or later · >= 2.5.0, < 2.8.7 · CVE-2023-26045 · GHSA-vh2g-6c4x-5hmp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 10.0
Hard-coded System User Credentials in Folio Data Export Spring module
Maven org.folio:mod-data-export-spring · Upgrade to 2.0.2 or 1.5.4 by release line · >= 2.0.0, < 2.0.2; < 1.5.4 · CVE-2024-23687 · GHSA-vf78-3q9f-92g3
- Critical, CVSS 9.3
SQL injection in audit endpoint
Maven org.apache.inlong:manager-service · Upgrade to 1.8.0 or later · >= 1.4.0, < 1.8.0 · CVE-2023-35088 · GHSA-r5pv-7g89-cxmc
- High, CVSS 8.7
JDBC URL bypassing by allowLoadLocalInfileInPath param
Maven org.apache.inlong:manager-pojo · Upgrade to 1.8.0 or later · >= 1.4.0, < 1.8.0 · CVE-2023-34434 · GHSA-pq67-9jf9-hc3c
- Critical, CVSS 9.3
Path Traversal in Apache Shiro
Maven org.apache.shiro:shiro-web · Upgrade to 2.0.0-alpha-3 (pre-release) or 1.12.0 by release line · < 1.12.0; >= 2.0.0-alpha-1, < 2.0.0-alpha-3 · CVE-2023-34478 · GHSA-pmhc-2g4f-85cg
- High, CVSS 7.6
Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Packagist pimcore/pimcore · Upgrade to 10.6.4 or later · < 10.6.4 · CVE-2023-3819 · GHSA-r87r-982q-2c3q
- High, CVSS 7.2
Pimcore vulnerable to SQL Injection in Dataobjects sorting
Packagist pimcore/pimcore · Upgrade to 10.6.4 or later · < 10.6.4 · CVE-2023-3820 · GHSA-c9hw-557q-f8hq
- Critical, CVSS 9.1
KubePi Privilege Escalation vulnerability
Go github.com/KubeOperator/kubepi · Upgrade to 1.6.5 or later · < 1.6.5 · CVE-2023-37917 · GHSA-757p-vx43-fp9r
- High, CVSS 7.5
Cockpit CMS vulnerable to incorrect access control
Packagist cockpit-hq/cockpit · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2023-37649 · GHSA-9r25-4j77-9wc7
- High, CVSS 8.8
Cockpit CMS Cross-Site Request Forgery vulnerability
Packagist cockpit-hq/cockpit · Upgrade to 2.6.0 or later · < 2.6.0 · CVE-2023-37650 · GHSA-45g2-r339-pjwf
- Critical, CVSS 9.1
OpenAM vulnerable to user impersonation using SAMLv1.x SSO process
Maven org.openidentityplatform.openam:openam-federation-library · Upgrade to 14.7.3 or later · < 14.7.3 · CVE-2023-37471 · GHSA-4mh8-9wq6-rjxg
- High, CVSS 7.5
Feathers socket handler allows abusing implicit toString
npm @feathersjs/socketio +1 · Upgrade all 2 to 5.0.8 or 4.5.18 by release line · <= 4.5.17; >= 5.0.0, <= 5.0.7 · CVE-2023-37899 · GHSA-hhr9-rh25-hvf9 · amended
- High, CVSS 7.2
grav Server-side Template Injection (SSTI) mitigation bypass
Packagist getgrav/grav · Upgrade to 1.7.42.2 or later · <= 1.7.42.1 · CVE-2023-37897 · GHSA-9436-3gmp-4f53
- High, CVSS 7.6
Hazelcast Executor Services don't check client permissions properly
Maven com.hazelcast:hazelcast +1 · Upgrade all 2 to 5.2.4, 5.1.7 or 5.0.5 by release line · >= 5.2.0, <= 5.2.3; >= 5.1.0, <= 5.1.6; <= 5.0.4 · CVE-2023-33265 · GHSA-c5vj-wp4v-mmvx
- Critical, CVSS 9.1
Access Control Bypass in Spring Security
Maven org.springframework.security:spring-security-config · Upgrade to 6.1.2, 6.0.5, 5.8.5 or 2 more by release line · >= 5.6.0, < 5.6.12; >= 5.7.0, < 5.7.10; >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2 · CVE-2023-34034 · GHSA-3h6f-g5f3-gc4w
- High, CVSS 8.8
Apache ShardingSphere-Agent Deserialization of Untrusted Data vulnerability
Maven org.apache.shardingsphere:shardingsphere · Upgrade to 5.4.0 or later · <= 5.3.2 · CVE-2023-28754 · GHSA-3cxh-xp3g-jxjm
- Critical, CVSS 10.0
MLflow Path Traversal vulnerability
PyPI mlflow · Upgrade to 2.5.0 or later · < 2.5.0 · CVE-2023-3765 · GHSA-fmxj-6h9g-6vw3 · amended
- High, CVSS 7.5
goproxy Denial of Service vulnerability
Go github.com/elazarl/goproxy · Upgrade to 0.0.0-20230731152917-f99041a5c027 (pre-release) or later · < 0.0.0-20230731152917-f99041a5c027 · CVE-2023-37788 · GHSA-4r8x-2p26-976p
- High, CVSS 8.8
1Panel command injection vulnerability in Firewall ip functionality
Go github.com/1Panel-dev/1Panel · Upgrade to 1.4.3 or later · <= 1.4.2 · CVE-2023-37477 · GHSA-p9xf-74xh-mhw5
- High, CVSS 7.3
Spring Security's authorization rules can be misconfigured when using multiple servlets
Maven org.springframework.security:spring-security-config · Upgrade to 6.1.2, 6.0.5 or 5.8.5 by release line · >= 5.8.0, < 5.8.5; >= 6.0.0, < 6.0.5; >= 6.1.0, < 6.1.2 · CVE-2023-34035 · GHSA-4vpr-xfrp-cj64
- Critical, CVSS 9.8
postgraas-server vulnerable to SQL injection
PyPI postgraas-server · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2018-25088 · GHSA-vghm-8cjp-hjw6 · amended
- Critical, CVSS 9.8
CasaOS contains weak JWT secrets
Go github.com/IceWhaleTech/CasaOS · Upgrade to 0.4.4 or later · < 0.4.4 · CVE-2023-37266 · GHSA-m5q5-8mfw-p2hr
- Critical, CVSS 9.8
CasaOS Gateway vulnerable to incorrect identification of source IP addresses
Go github.com/IceWhaleTech/CasaOS-Gateway · Upgrade to 0.4.4 or later · < 0.4.4 · CVE-2023-37265 · GHSA-vjh7-5r6x-xh6g
- High, CVSS 7.5
avro vulnerable to denial of service via attacker-controlled parameter
Go github.com/hamba/avro +1 · Upgrade all 2 to 2.13.0 or later · < 2.13.0 · CVE-2023-37475 · GHSA-9x44-9pgq-cf45
- Critical, CVSS 10.0
Mongoose Prototype Pollution vulnerability
npm mongoose · Upgrade to 7.3.3, 6.11.3 or 5.13.20 by release line · >= 7.0.0, < 7.3.3; >= 6.0.0, < 6.11.3; < 5.13.20 · CVE-2023-3696 · GHSA-9m93-w8w6-76hh · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.