High, CVSS 8.8
Apache Ambari Expression Language Injection vulnerability
Maven org.apache.ambari:ambari · Upgrade to 2.7.7 or later · >= 2.7.0, < 2.7.7 · CVE-2022-45855 · GHSA-p7w2-784m-qpq9
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Apache Ambari Expression Language Injection vulnerability
Maven org.apache.ambari:ambari · Upgrade to 2.7.7 or later · >= 2.7.0, < 2.7.7 · CVE-2022-42009 · GHSA-m384-pj54-5vr2
- High, CVSS 8.8
Apache Jena Expression Language Injection vulnerability
Maven org.apache.jena:jena · Upgrade to 4.9.0 or later · >= 3.7.0, < 4.9.0 · CVE-2023-32200 · GHSA-j927-w6g7-7c7w
- High, CVSS 8.1
Decidim Cross-site Scripting vulnerability in the processes filter
RubyGems decidim +1 · Upgrade all 2 to 0.27.3 or 0.26.7 by release line · >= 0.27.0, < 0.27.3; >= 0.14.0, < 0.26.7 · CVE-2023-34089 · GHSA-5652-92r9-3fx9
- High, CVSS 7.5
Decidim vulnerable to sensitive data disclosure
RubyGems decidim +1 · Upgrade all 2 to 0.27.3 or later · >= 0.27.0, < 0.27.3 · CVE-2023-34090 · GHSA-jm79-9pm4-vrw9
- Critical, CVSS 9.8
Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution
Packagist orchid/platform · Upgrade to 14.5.0 or later · >= 14.0.0-alpha4, < 14.5.0 · CVE-2023-36825 · GHSA-ph6g-p72v-pc3p
- High, CVSS 8.1
Microsoft Security Advisory CVE-2023-33127: .NET Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 +2 · Upgrade all 3 to 7.0.9 or 6.0.20 by release line · >= 6.0.0, < 6.0.20; >= 7.0.0, < 7.0.9 · CVE-2023-33127 · GHSA-485r-rp8v-998v
- High, CVSS 8.1
Microsoft Security Advisory CVE-2023-33170: .NET Security Feature Bypass Vulnerability
NuGet microsoft.aspnetcore.app.runtime.linux-arm64 · Upgrade to 7.0.9 or 6.0.20 by release line · < 6.0.20; >= 7.0.0, < 7.0.9 · +13 more packages · CVE-2023-33170 · GHSA-25c8-p796-jg6r
- Critical, CVSS 9.8
xalpha vulnerable to Remote Code Execution
PyPI xalpha · Upgrade to 0.11.9 or later · >= 0.11.4, < 0.11.9 · CVE-2023-37659 · GHSA-jx3q-5rgf-vrrr · amended
- High, CVSS 8.4
RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape
PyPI restrictedpython · Upgrade to 6.1 or 5.3 by release line · < 5.3; >= 6.0a1.dev0, < 6.1; < 5.3 · CVE-2023-37271 · GHSA-wqc8-x2pr-7jqh · amended
- Critical, CVSS 9.6
XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API
Maven org.xwiki.platform:xwiki-platform-rest-server · Upgrade to 15.2 or 14.10.8 by release line · >= 1.8, < 14.10.8; >= 15.0-rc-1, < 15.2 · +2 more packages · CVE-2023-37277 · GHSA-6xxr-648m-gch6
- High, CVSS 7.5
TeamPass information exposure vulnerability
Packagist nilsteampassnet/teampass · Upgrade to 3.0.10 or later · < 3.0.10 · CVE-2023-3553 · GHSA-2rhg-hqq9-8xjh
- High, CVSS 7.6
TeamPass vulnerable to Improper Encoding or Escaping of Output
Packagist nilsteampassnet/teampass · Upgrade to 3.0.10 or later · < 3.0.10 · CVE-2023-3552 · GHSA-2cv5-qvq3-6276
- Critical, CVSS 9.1
TeamPass Code Injection vulnerability
Packagist nilsteampassnet/teampass · Upgrade to 3.0.10 or later · < 3.0.10 · CVE-2023-3551 · GHSA-97hm-2mfr-2p97
- High, CVSS 8.8
Archive_Tar contains Potential RCE if filename starts with phar://
Packagist pear/archive_tar · Upgrade to 1.4.4 or later · < 1.4.4 · CVE-2018-1000888 · GHSA-3q76-jq6m-573p
- High, CVSS 8.1
TeamPass Cross-site Scripting vulnerability
Packagist nilsteampassnet/teampass · Upgrade to 3.0.10 or later · < 3.0.10 · CVE-2023-3531 · GHSA-pwrw-g29q-3mp8
- High, CVSS 7.5
gRPC Reachable Assertion issue
RubyGems grpc +2 · Upgrade all 3 to 1.53.0 or later · >= 1.51.0, < 1.53.0 · CVE-2023-1428 · GHSA-6628-q6j9-w8vg · amended
- High, CVSS 7.2
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
PyPI apache-airflow-providers-cncf-kubernetes · Upgrade to 7.0.0 or later · >= 5.0.0, < 7.0.0 · CVE-2023-33234 · GHSA-2rx4-9f5h-9gjf · amended
- High, CVSS 7.8
Apache Cassandra: Privilege escalation when enabling FQL/Audit logs
Maven org.apache.cassandra:cassandra-all · Upgrade to 4.1.2 or 4.0.10 by release line · >= 4.1.0, < 4.1.2; >= 4.0.0, < 4.0.10 · CVE-2023-30601 · GHSA-m9p2-j4hg-g373
- Critical, CVSS 9.8Exploited · CISA KEV
Apache RocketMQ may have remote code execution vulnerability when using update configuration function
Maven org.apache.rocketmq:rocketmq-controller · Upgrade to 5.1.1 or later · >= 5.0.0, < 5.1.1 · +2 more packages · CVE-2023-33246 · GHSA-x3cq-8f32-5f63
- Critical, CVSS 9.1
Apache InLong has Files or Directories Accessible to External Parties in Apache InLong
Maven org.apache.inlong:manager-web +1 · Upgrade all 2 to 1.7.0 or later · >= 1.4.0, < 1.7.0 · CVE-2023-31066 · GHSA-wx79-r3q8-fq9h
- High, CVSS 7.5
Apache InLong Incorrect Permission Assignment for Critical Resource Vulnerability
Maven org.apache.inlong:manager-web +1 · Upgrade all 2 to 1.7.0 or later · >= 1.2.0, < 1.7.0 · CVE-2023-31453 · GHSA-8rjh-3mhm-966q
- High, CVSS 7.5
Apache Tomcat - Fix for CVE-2023-24998 was incomplete
Maven org.apache.tomcat:tomcat-coyote · Upgrade to 8.5.88 or later · >= 8.5.85, < 8.5.88 · +1 more package · CVE-2023-28709 · GHSA-cx6h-86xw-9x34
- High, CVSS 7.5
Apache InLong has Files or Directories Accessible to External Parties
Maven org.apache.inlong:manager-workflow · Upgrade to 1.7.0 or later · >= 1.2.0, < 1.7.0 · CVE-2023-31064 · GHSA-3p9p-59qf-mqwh
- High, CVSS 7.5
Apache InLong Deserialization of Untrusted Data Vulnerability
Maven org.apache.inlong:manager-pojo +1 · Upgrade all 2 to 1.7.0 or later · >= 1.4.0, < 1.7.0 · CVE-2023-31058 · GHSA-c3rh-f2w5-fghm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.