High, CVSS 7.5
Apache InLong Exposure of Resource to Wrong Sphere vulnerability
Maven org.apache.inlong:manager-test +4 · Upgrade all 5 to 1.7.0 or later · >= 1.4.0, < 1.7.0 · CVE-2023-31206 · GHSA-f475-jgg3-3jwc
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.1
Apache InLong Insufficient Session Expiration vulnerability
Maven org.apache.inlong:manager-web +3 · Upgrade all 4 to 1.7.0 or later · >= 1.4.0, < 1.7.0 · CVE-2023-31065 · GHSA-757p-7hp5-pqmr
- Critical, CVSS 9.8
Apache InLong Improper Privilege Management vulnerability
Maven org.apache.inlong:manager-web +3 · Upgrade all 4 to 1.7.0 or later · >= 1.2.0, < 1.7.0 · CVE-2023-31062 · GHSA-q5p5-xg93-2jqc
- High, CVSS 7.5
Apache InLong Exposure of Resource to Wrong Sphere vulnerability
Maven org.apache.inlong:manager-test +4 · Upgrade all 5 to 1.7.0 or later · >= 1.4.0, < 1.7.0 · CVE-2023-31103 · GHSA-7mhc-76hf-3jp9
- High, CVSS 7.5
Apache InLong vulnerable to Incorrect Permission Assignment for Critical Resource
Maven org.apache.inlong:manager-service · Upgrade to 1.7.0 or later · >= 1.2.0, < 1.7.0 · CVE-2023-31454 · GHSA-rf76-whgp-fp56
- High, CVSS 8.8
Apache Ranger code execution vulnerability in policy expressions
Maven org.apache.ranger:ranger · Upgrade to 2.4.0 or later · >= 2.3.0, <= 2.3.0 · CVE-2022-45048 · GHSA-89gw-cffj-mqg9
- High, CVSS 8.2
league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase
Packagist league/oauth2-server · Upgrade to 8.5.3 or 8.4.2 by release line · >= 8.3.2, < 8.4.2; >= 8.5.0, < 8.5.3 · CVE-2023-37260 · GHSA-wj7q-gjg8-3cpm
- High, CVSS 7.5
ethyca-fides Webserver API Path Traversal vulnerability
PyPI ethyca-fides · Upgrade to 2.15.1 or later · < 2.15.1 · CVE-2023-36827 · GHSA-r25m-cr6v-p9hq · amended
- High, CVSS 7.1
Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of
styleelement contentRubyGems sanitize · Upgrade to 6.0.2 or later · >= 3.0.0, < 6.0.2 · CVE-2023-36823 · GHSA-f5ww-cq3m-q3g7
- Critical, CVSS 9.8
Apache StreamPark Path Traversal vulnerability
Maven org.apache.streampark:streampark-common_2.12 +1 · Upgrade all 2 to 2.0.0 or later · < 2.0.0 · CVE-2022-45802 · GHSA-6874-289g-f7h7
- Critical, CVSS 9.1
Apache StreamPark Improper Input Validation vulnerability
Maven org.apache.streampark:streampark · Upgrade to 2.0.0 or later · >= 1.0.0, < 2.0.0 · CVE-2022-46365 · GHSA-m5h8-2pjw-vg3j
- Critical, CVSS 9.8
Apache Linkis Unrestricted File Upload vulnerability
Maven org.apache.linkis:linkis · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2023-27602 · GHSA-x84r-jrqm-3hj8
- Critical, CVSS 9.8
HtmlUnit Code Injection vulnerability
Maven net.sourceforge.htmlunit:htmlunit · Upgrade to 3.0.0 or later · < 3.0.0 · CVE-2023-26119 · GHSA-3xrr-7m6p-p7xh
- Critical, CVSS 9.1
Apache Linkis Authentication Bypass vulnerability
Maven org.apache.linkis:linkis · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2023-27987 · GHSA-4x5h-xmv4-99wx
- Critical, CVSS 9.8
Apache Linkis Zip Slip issue
Maven org.apache.linkis:linkis · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2023-27603 · GHSA-pj5j-w7mw-w797
- High, CVSS 8.1
Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation
Go github.com/hashicorp/vault · Upgrade to 1.12.4, 1.11.8 or 1.10.11 by release line · < 1.10.11; >= 1.11.0, < 1.11.8; >= 1.12.0, < 1.12.4 · CVE-2023-24999 · GHSA-wmg5-g953-qqfw
- High, CVSS 7.1
HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured
Go github.com/hashicorp/boundary · Upgrade to 0.12.0 or later · >= 0.10.0, < 0.12.0 · CVE-2023-0690 · GHSA-9vrm-v9xv-x3xr
- High, CVSS 8.8
snyk Code Injection vulnerability
npm snyk · Upgrade to 1.1064.0 or later · < 1.1064.0 · CVE-2022-24441 · GHSA-4vrv-93c7-m92j · amended
- Critical, CVSS 9.8
Apache Kylin vulnerable to remote code execution
Maven org.apache.kylin:kylin-spark-project +2 · Upgrade all 3 to 4.0.2 or later · < 4.0.2 · CVE-2022-24697 · GHSA-ppxx-m926-g569
- High, CVSS 8.7
langchain SQL Injection vulnerability
PyPI langchain · Upgrade to 0.0.247 or later · < 0.0.247 · CVE-2023-36189 · GHSA-7q94-qpjr-xpgm · amended
- Critical, CVSS 9.8
langchain vulnerable to arbitrary code execution
PyPI langchain · Upgrade to 0.0.247 or later · < 0.0.247 · CVE-2023-36188 · GHSA-57fc-8q82-gfp3 · amended
- High, CVSS 8.7
Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
PyPI products-cmfcore · Upgrade to 3.2 or 2.7.1 by release line · >= 3.0, < 3.2; < 2.7.1 · CVE-2023-36814 · GHSA-4hpj-8rhv-9x87 · amended
- High, CVSS 8.1
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
PyPI kiwitcms · Upgrade to 12.5 or later · < 12.5 · CVE-2023-36809 · GHSA-jpgw-2r9m-8qfw · amended
- High, CVSS 7.4
@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state
npm @fastify/oauth2 · Upgrade to 7.2.0 or later · < 7.2.0 · CVE-2023-31999 · GHSA-g8x5-p9qc-cf95 · amended
- High, CVSS 8.7
MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form
PyPI mechanicalsoup · Upgrade to 1.3.0 or later · >= 0.2.0, < 1.3.0 · CVE-2023-34457 · GHSA-x456-3ccm-m6j4 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.