Critical, CVSS 9.8
Moodle SQL Injection vulnerability
Packagist moodle/moodle · Upgrade to 3.11.1, 3.10.5 or 3.9.8 by release line · >= 3.11.0-beta, < 3.11.1; >= 3.10.0-beta, < 3.10.5; < 3.9.8 · CVE-2021-36392 · GHSA-qc86-vgf2-6fq6
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Moodle vulnerable to Uncontrolled Resource Consumption
Packagist moodle/moodle · Upgrade to 3.11.1, 3.10.5 or 3.9.8 by release line · >= 3.11.0-beta, < 3.11.1; >= 3.10.0-beta, < 3.10.5; < 3.9.8 · CVE-2021-36395 · GHSA-273w-7fxj-pcp6
- Critical, CVSS 9.8
Moodle SQL Injection vulnerability
Packagist moodle/moodle · Upgrade to 3.11.1, 3.10.5 or 3.9.8 by release line · >= 3.11.0-beta, < 3.11.1; >= 3.10.0-beta, < 3.10.5; < 3.9.8 · CVE-2021-36393 · GHSA-f46j-r7q3-6cm2
- High, CVSS 7.5
Moodle vulnerable to Server-Side Request Forgery
Packagist moodle/moodle · Upgrade to 3.11.1, 3.10.5 or 3.9.8 by release line · >= 3.11.0-beta, < 3.11.1; >= 3.10.0-beta, < 3.10.5; < 3.9.8 · CVE-2021-36396 · GHSA-4rmj-w58m-fvch
- Critical, CVSS 9.8
Moodle Session Fixation vulnerability
Packagist moodle/moodle · Upgrade to 3.11.1, 3.10.5 or 3.9.8 by release line · >= 3.11.0-beta, < 3.11.1; >= 3.10.0-beta, < 3.10.5; < 3.9.8 · CVE-2021-36394 · GHSA-2563-fp9c-mgm8
- Critical, CVSS 9.3
json-logic-js Command Injection vulnerability
npm json-logic-js · Upgrade to 2.0.1 or later · < 2.0.1 · CVE-2021-4329 · GHSA-67j4-2mh6-8627 · amended
- High, CVSS 7.5
Yapscan Denial of Service vulnerability in report server
Go github.com/fkie-cad/yapscan · Upgrade to 0.19.2 or later · >= 0.18.0, < 0.19.2 · GHSA-wxwq-525w-hcqx
- High, CVSS 8.9
XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data
Maven org.xwiki.platform:xwiki-platform-livedata-macro · Upgrade to 14.9, 14.4.7 or 13.10.10 by release line · >= 12.10, < 13.10.10; >= 14.0, < 14.4.7; >= 14.5, < 14.9 · CVE-2023-26480 · GHSA-32fq-m2q5-h83g
- Critical, CVSS 10.0
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
Maven org.xwiki.platform:xwiki-platform-flamingo-theme-ui · Upgrade to 14.9-rc-1 (pre-release), 14.4.6 or 13.10.10 by release line · >= 6.2.4, < 13.10.10; >= 14.0, < 14.4.6; >= 14.5, < 14.9-rc-1 · CVE-2023-26477 · GHSA-x2qm-r4wx-8gpg
- Critical, CVSS 9.9
XWiki Platform users may execute anything with superadmin right through comments and async macro
Maven org.xwiki.platform:xwiki-platform-rendering-async-macro · Upgrade to 14.9, 14.4.6 or 13.10.10 by release line · >= 11.6-rc-1, < 13.10.10; >= 14.0, < 14.4.6; >= 14.5, < 14.9 · CVE-2023-26471 · GHSA-9cqm-5wf7-wcj7
- Critical, CVSS 9.9
XWiki Platform may allow privilege escalation to programming rights via user's first name
Maven org.xwiki.commons:xwiki-commons-xml · Upgrade to 14.7-rc-1 (pre-release), 14.4.4 or 13.10.9 by release line · >= 3.1-milestone-1, < 13.10.9; >= 14.0-rc-1, < 14.4.4; >= 14.5, < 14.7-rc-1 · CVE-2023-26055 · GHSA-8cw6-4r32-6r3h
- Critical, CVSS 9.9
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
Maven org.xwiki.platform:xwiki-platform-icon-ui · Upgrade to 14.9, 14.4.6 or 13.10.10 by release line · >= 6.2-milestone-1, < 13.10.10; >= 14.0, < 14.4.6; >= 14.5, < 14.9 · CVE-2023-26472 · GHSA-vwr6-qp4q-2wj7
- Critical, CVSS 9.9
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
Maven org.xwiki.platform:xwiki-platform-oldcore +1 · Upgrade all 2 to 14.10, 14.4.7 or 13.10.11 by release line · >= 13.10, < 13.10.11; >= 14.0, < 14.4.7; >= 14.5, < 14.10 · CVE-2023-26474 · GHSA-3738-p9x3-mv9r
- High, CVSS 7.5
XWiki Platform packages Expose Sensitive Information to an Unauthorized Actor
Maven org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki +1 · Upgrade all 2 to 14.7-rc-1 (pre-release), 13.10.9 or 13.4.4 by release line · >= 3.2-m3, < 13.4.4; >= 13.5.0, < 13.10.9; >= 14.0.0, < 14.7-rc-1 · CVE-2023-26476 · GHSA-5cf8-vrr8-8hjm
- High, CVSS 7.0
Opencontainers runc Incorrect Authorization vulnerability
Go github.com/opencontainers/runc · Upgrade to 1.1.5 or later · >= 1.0.0-rc95, < 1.1.5 · CVE-2023-27561 · GHSA-vpvm-3wq2-2wvm
- High, CVSS 7.5
phpseclib Infinite Loop vulnerability
Packagist phpseclib/phpseclib · Upgrade to 3.0.19 or later · >= 3.0.0, < 3.0.19 · CVE-2023-27560 · GHSA-hm7p-r324-hhf3
- High, CVSS 8.7
Keycloak vulnerable to user impersonation via stolen UUID code
Maven org.keycloak:keycloak-services · Upgrade to 21.0.1 or later · < 21.0.1 · CVE-2023-0264 · GHSA-9g98-5mj6-f9mv
- Critical, CVSS 9.9
xwiki-platform vulnerable to Remote Code Execution in Annotations
Maven org.xwiki.platform:xwiki-platform-annotation-ui · Upgrade to 14.10, 14.4.7 or 13.10.11 by release line · >= 2.3-milestone-1, < 13.10.11; >= 14.0-rc-1, < 14.4.7; >= 14.5, < 14.10 · CVE-2023-26475 · GHSA-h6f5-8jj5-cxhr
- High, CVSS 7.5
nistec has Incorrect Calculation in Multiplication of unreduced P-256 scalars
Go filippo.io/nistec · Upgrade to 0.0.2 or later · < 0.0.2 · CVE-2023-24533 · GHSA-f6hc-9g49-xmx7
- High, CVSS 8.8
Kubernetes vulnerable to validation bypass
Go github.com/kubernetes/kubernetes · Upgrade to 1.25.4, 1.24.8, 1.23.14 or 1.22.16 by release line · >= 1.25.0, < 1.25.4; >= 1.22.0, < 1.22.16; >= 1.24.0, < 1.24.8; >= 1.23.0, < 1.23.14 · CVE-2022-3294 · GHSA-jh36-q97c-9928
- High, CVSS 8.7
Lemur subject to insecure random generation
PyPI lemur · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2023-30797 · GHSA-5fqv-mpj8-h7gm · amended
- High, CVSS 8.1
Keycloak Cross-site Scripting on OpenID connect login service
Maven org.keycloak:keycloak-parent · Upgrade to 20.0.5 or later · < 20.0.5 · CVE-2022-4137 · GHSA-9hhc-pj4w-w5rv
- High, CVSS 7.7
api-platform/core's secured properties may be accessible within collections
Packagist api-platform/core · Upgrade to 3.1.3, 3.0.12 or 2.7.10 by release line · >= 3.0.0, < 3.0.12; >= 3.1.0, < 3.1.3; >= 2.6.0, < 2.7.10 · CVE-2023-25575 · GHSA-vr2x-7687-h6qv
- High, CVSS 8.7
vantage6 refresh tokens do not expire
PyPI vantage6 · Upgrade to 3.8.0 or later · < 3.8.0 · CVE-2023-23929 · GHSA-4w59-c3gc-rrhp · amended
- High, CVSS 7.1
vantage6 vulnerable to Improper Preservation of Permissions
PyPI vantage6 · Upgrade to 3.8.0 or later · < 3.8.0 · CVE-2023-22738 · GHSA-vvjv-97j8-94xh · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.