High, CVSS 7.5
hjson stack exhaustion vulnerability
Packagist laktak/hjson · Upgrade to 2.3.0 or later · < 2.3.0 · +2 more packages · CVE-2023-34620 · GHSA-5wfc-hjrc-gq87
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 398 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 578 in the 30 days before.
- Critical
- 64 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
htmlcleaner vulnerable to stack exhaustion
Maven net.sourceforge.htmlcleaner:htmlcleaner · Upgrade to 2.29 or later · < 2.29 · CVE-2023-34624 · GHSA-jv4x-j47q-6qvp
- High, CVSS 8.1
SSL/TLS certificate validation disabled by default in Jenkins Checkmarx Plugin
Maven com.checkmarx.jenkins:checkmarx · Upgrade to 2023.2.6 or later · <= 2022.4.3 · CVE-2023-35142 · GHSA-rr3p-5fcf-v5m3
- High, CVSS 8.0
Jenkins CSRF protection bypass vulnerability
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.400 or later · < 2.400 · CVE-2023-35141 · GHSA-98fp-r22g-wpj7
- Critical, CVSS 9.2
nuxt Code Injection vulnerability
npm nuxt · Upgrade to 3.4.3 or later · >= 3.4.0, < 3.4.3 · CVE-2023-3224 · GHSA-gc34-5v43-h7v8 · amended
- High, CVSS 7.5
Dolibarr vulnerable to unauthenticated database access
Packagist dolibarr/dolibarr · Upgrade to 16.0.5 or later · >= 16.0.0, < 16.0.5 · CVE-2023-33568 · GHSA-fpvg-m786-h5vr
- High, CVSS 7.1
Insecure Temporary File in HuTool
Maven cn.hutool:hutool-core · Upgrade to 5.8.19 or later · < 5.8.19 · CVE-2023-33695 · GHSA-7mcw-xmx3-7p8m
- High, CVSS 8.3
tgstation-server cached user logins in legacy server
NuGet tgserviceinterface · Upgrade to 3.2.5.0 or later · >= 3.2.1.0, <= 3.2.4.0 · CVE-2018-17107 · GHSA-42r6-p4px-qvv6
- High, CVSS 8.8
Apache NiFi vulnerable to Code Injection
Maven org.apache.nifi:nifi-dbcp-service-nar +2 · Upgrade all 3 to 1.22.0 or later · >= 0.0.2, < 1.22.0 · CVE-2023-34468 · GHSA-xm2m-2q6h-22jw
- Critical, CVSS 9.8
GeoServer RCE due to improper control of generation of code in jai-ext
Jifflemap algebra languageMaven org.geoserver:gs-wfs +2 · Upgrade all 3 to 2.20.4, 2.19.6 or 2.18.6 by release line · < 2.18.6; >= 2.19.0, < 2.19.6; >= 2.20.0, < 2.20.4 · CVE-2023-35042 · GHSA-59x6-g4jr-4hxc
- High, CVSS 8.2
progressbar.js vulnerable to Prototype Pollution
npm progressbar.js · Upgrade to 1.1.1 or later · < 1.1.1 · CVE-2023-26133 · GHSA-89qm-hm2x-mxm3 · amended
- High, CVSS 7.5
dottie vulnerable to Prototype Pollution
npm dottie · Upgrade to 2.0.4 or later · < 2.0.4 · CVE-2023-26132 · GHSA-4gxf-g5gf-22h4 · amended
- High, CVSS 7.5
HashiCorp Consul Incorrect Access Control vulnerability
Go github.com/hashicorp/consul · Upgrade to 1.5.1 or later · >= 1.4.0, < 1.5.1 · CVE-2019-12291 · GHSA-h65h-v7fw-4p38
- High, CVSS 7.3
Snowflake NodeJS Driver vulnerable to Command Injection
npm snowflake-sdk · Upgrade to 1.6.21 or later · < 1.6.21 · CVE-2023-34232 · GHSA-h53w-7qw7-vh5c · amended
- High, CVSS 7.3
Snowflake Golang Driver vulnerable to Command Injection
Go github.com/snowflakedb/gosnowflake · Upgrade to 1.6.19 or later · < 1.6.19 · CVE-2023-34231 · GHSA-fwv2-65wh-2w8c
- High, CVSS 8.5
Snowflake Python Connector vulnerable to Command Injection
PyPI snowflake-connector-python · Upgrade to 3.0.2 or later · < 3.0.2 · CVE-2023-34233 · GHSA-5w5m-pfw9-c8fp · amended
- High, CVSS 8.1
@udecode/plate-link does not sanitize URLs to prevent use of the
javascript:schemenpm @udecode/plate-link · Upgrade to 20.0.0 or later · < 20.0.0 · CVE-2023-34245 · GHSA-4882-hxpr-hrvm · amended
- High, CVSS 7.3
Snowflake Connector .Net Command Injection
NuGet snowflake.data · Upgrade to 2.0.18 or later · < 2.0.18 · CVE-2023-34230 · GHSA-223g-8w3x-98wr
- Critical, CVSS 9.8
Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts
Packagist froxlor/froxlor · Upgrade to 2.0.20 or later · < 2.0.20 · CVE-2023-3173 · GHSA-chw4-88xc-79w6
- High, CVSS 7.2
Froxlor vulnerable to Path Traversal
Packagist froxlor/froxlor · Upgrade to 2.0.20 or later · < 2.0.20 · CVE-2023-3172 · GHSA-ghqq-jfx7-f6m9
- High, CVSS 7.5
Grafana Missing Synchronization vulnerability
Go github.com/grafana/grafana · Upgrade to 9.5.3 or 9.4.12 by release line · < 9.4.12; >= 9.5.0, < 9.5.3 · CVE-2023-2801 · GHSA-x2w4-c67p-g44j
- High, CVSS 7.5
RedCloth Regular Expression Denial of Service issue
RubyGems RedCloth · Upgrade to 4.3.3 or later · < 4.3.3 · CVE-2023-31606 · GHSA-qcm3-vfq5-wfr2
- High, CVSS 7.5
fast-xml-parser vulnerable to Regex Injection via Doctype Entities
npm fast-xml-parser · Upgrade to 4.2.4 or later · >= 4.1.3, < 4.2.4 · CVE-2023-34104 · GHSA-6w63-h3fj-q4vw · amended
- High, CVSS 8.3
avo possible unsafe reflection / partial DoS vulnerability
RubyGems avo · Upgrade to 2.33.3; some affected versions have no fix yet · <= 2.33.2; >= 3.0.0.pre1, <= 3.0.0.pre12 · CVE-2023-34102 · GHSA-86h2-2g4g-29qx
- High, CVSS 8.1
kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload
PyPI kiwitcms · Upgrade to 12.4 or later · <= 12.3 · CVE-2023-33977 · GHSA-2fqm-m4r2-fh98 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.