Critical, CVSS 9.3
CleverTap Cordova plugin vulnerable to Cross-site Scripting
npm clevertap-cordova · Upgrade to 2.7.0 or later · < 2.7.0 · CVE-2023-2507 · GHSA-x2ph-qqwm-9cc6 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
rswag vulnerable to arbitrary JSON and YAML file read via directory traversal
RubyGems rswag · Upgrade to 2.10.1 or later · < 2.10.1 · CVE-2023-38337 · GHSA-vc79-65pr-q82v
- High, CVSS 8.7
copyparty vulnerable to path traversal attack
PyPI copyparty · Upgrade to 1.8.2 or later · < 1.8.2 · CVE-2023-37474 · GHSA-pxfv-7rr3-2qjg · amended
- High, CVSS 8.5
zenstruck/collection passing callable string to EntityRepository::find() and query()
Packagist zenstruck/collection · Upgrade to 0.2.1 or later · < 0.2.1 · CVE-2023-37473 · GHSA-7xr2-8ff7-6fjq
- Critical, CVSS 9.9
org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerability
Maven org.xwiki.platform:xwiki-platform-skin-ui · Upgrade to 14.10.4 or 14.4.8 by release line · >= 7.0-rc-1, < 14.4.8; >= 14.5, < 14.10.4 · CVE-2023-37462 · GHSA-h4vp-69r8-gvjg
- High, CVSS 8.5
Weave GitOps Terraform Controller Information Disclosure Vulnerability
Go github.com/weaveworks/tf-controller · Upgrade to 0.15.0-rc.5 (pre-release) or 0.14.4 by release line · < 0.14.4; >= 0.15.0-rc.1, < 0.15.0-rc.5 · CVE-2023-34236 · GHSA-6hvv-j432-23cv
- High, CVSS 7.5
PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket
Packagist pocketmine/pocketmine-mp · Upgrade to 5.2.1 or 4.22.3 by release line · >= 4.20.0, < 4.22.3; >= 5.0.0, < 5.2.1 · GHSA-7wrv-6h42-w54f
- High, CVSS 8.7
cryptography mishandles SSH certificates
PyPI cryptography · Upgrade to 41.0.2 or later · >= 40.0.0, < 41.0.2 · CVE-2023-38325 · GHSA-cf7p-gm2m-833m · amended
- High, CVSS 7.2
Pimcore SQL Injection vulnerability
Packagist pimcore/pimcore · Upgrade to 10.5.24 or later · < 10.5.24 · CVE-2023-3673 · GHSA-rxp5-qwrf-pfv3
- High, CVSS 7.3
webmention.js Cross-site Scripting vulnerability
npm webmention.js · Upgrade to 0.5.5 or later · < 0.5.5 · CVE-2023-3672 · GHSA-r54g-4qq6-chxg · amended
- High, CVSS 7.5
Spring-boot-admin sandbox bypass via crafted HTML
Maven de.codecentric:spring-boot-admin-server · Upgrade to 3.1.2 or 2.7.16 by release line · >= 3.0.0, < 3.1.2; < 2.7.16 · CVE-2023-38286 · GHSA-7gj7-224w-vpr3
- Critical, CVSS 9.1
Froxlor vulnerable to Improper Encoding or Escaping of Output
Packagist froxlor/froxlor · Upgrade to 2.0.21 or later · < 2.0.21 · CVE-2023-3668 · GHSA-c6v5-pf66-xfq8
- High, CVSS 7.1
mx-chain-go's relayed transactions always increment nonce
Go github.com/multiversx/mx-chain-go · Upgrade to 1.4.17 or later · < 1.4.17 · CVE-2023-34458 · GHSA-j494-7x2v-vvvp
- High, CVSS 7.5
Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions
NuGet umbraco.cms.web.backoffice +1 · Upgrade all 2 to 12.0.1, 11.4.2 or 10.6.1 by release line · >= 9.0.0, < 10.6.1; >= 11.0.0, < 11.4.2; >= 12.0.0, <= 12.0.0 · CVE-2023-37267 · GHSA-h8wc-r4jh-mg7m
- Critical, CVSS 9.8
vm2 Sandbox Escape vulnerability
npm vm2 · Upgrade to 3.10.0 or later · <= 3.9.19 · CVE-2023-37466 · GHSA-cchq-frgv-rjh5 · amended
- High, CVSS 8.8
Apache Airflow Apache Hive Provider Improper Input Validation vulnerability
PyPI apache-airflow-providers-apache-hive · Upgrade to 6.1.2 or later · < 6.1.2 · CVE-2023-37415 · GHSA-4q2q-q5pw-2342 · amended
- High, CVSS 8.8
Jenkins OpenShift Login Plugin session fixation vulnerability
Maven org.openshift.jenkins:openshift-login · Upgrade to 1.1.0.230.v5d7030b (pre-release) or later · < 1.1.0.230.v5d7030b · CVE-2023-37946 · GHSA-rwg5-2pv9-633w
- High, CVSS 7.1
Apache Airflow Incorrect Authorization vulnerability
PyPI apache-airflow · Upgrade to 2.6.3 or later · < 2.6.3 · CVE-2023-35908 · GHSA-2h84-3crq-vgfj · amended
- Critical, CVSS 9.6
Apache Pulsar Incorrect Authorization vulnerability
Maven org.apache.pulsar:pulsar · Upgrade to 2.11.1 or 2.10.4 by release line · < 2.10.4; >= 2.11.0, <= 2.11.0 · CVE-2023-30429 · GHSA-g9cv-v3v4-3h8r
- Critical, CVSS 9.8
RocketMQ NameServer component Code Injection vulnerability
Maven org.apache.rocketmq:rocketmq-namesrv · Upgrade to 5.1.2 or 4.9.7 by release line · < 4.9.7; >= 5.0.0, < 5.1.2 · CVE-2023-37582 · GHSA-gpq8-963w-8qc9
- High, CVSS 7.1
Apache Airflow Improper Input Validation vulnerability
PyPI apache-airflow · Upgrade to 2.6.3 or later · < 2.6.3 · CVE-2023-22888 · GHSA-5946-8p38-vffp · amended
- High, CVSS 8.2
Apache Pulsar Broker's Rest Producer vulnerable to Incorrect Authorization
Maven org.apache.pulsar:pulsar-broker · Upgrade to 2.11.1 or 2.10.4 by release line · >= 2.9.0, < 2.10.4; >= 2.11.0, <= 2.11.0 · CVE-2023-30428 · GHSA-j2r7-3rvw-g7gx
- High, CVSS 7.1
Apache Airflow Path Traversal vulnerability
PyPI apache-airflow · Upgrade to 2.6.3 or later · < 2.6.3 · CVE-2023-22887 · GHSA-ggwr-4vr8-g7wv · amended
- High, CVSS 7.1
Apache Airflow Improper Input Validation vulnerability
PyPI apache-airflow · Upgrade to 2.6.3 or later · < 2.6.3 · CVE-2023-36543 · GHSA-3h4m-m55v-gx4m · amended
- High, CVSS 7.1
Apache Airflow information disclosure vulnerability
PyPI apache-airflow · Upgrade to 2.6.3 or later · < 2.6.3 · CVE-2022-46651 · GHSA-xvw9-3mhm-xjqq · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.