High, CVSS 8.7
MultipartParser denial of service with too many fields or files
PyPI starlette · Upgrade to 0.25.0 or later · < 0.25.0 · CVE-2023-30798 · GHSA-74m5-2c7w-9w3x · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
Command injection in Apache Sling
Maven org.apache.sling:org.apache.sling.jcr.base · Upgrade to 3.1.12 or later · < 3.1.12 · CVE-2023-25141 · GHSA-gvg3-83q4-rfhq
- High, CVSS 8.8
SameSite Attribute vulnerability in pimCore
Packagist pimcore/pimcore · Upgrade to 10.5.16 or later · < 10.5.16 · CVE-2023-25240 · GHSA-r2vq-p658-p274
- High, CVSS 7.5
Regular Expression Denial of Service in simple-markdown
npm simple-markdown · Upgrade to 0.6.1 or later · < 0.6.1 · CVE-2019-25102 · GHSA-j533-2g8v-pmpg · amended
- High, CVSS 8.8
Uncaught Exception in thorsten/phpmyfaq
Packagist thorsten/phpmyfaq · Upgrade to 3.1.11 or later · < 3.1.11 · CVE-2023-0790 · GHSA-6vv4-qq3r-9rv8
- Critical, CVSS 9.8
Command Injection in thorsten/phpmyfaq
Packagist thorsten/phpmyfaq · Upgrade to 3.1.11 or later · < 3.1.11 · CVE-2023-0789 · GHSA-6vp5-vv9p-7q62
- Critical, CVSS 9.8
Code Injection in thorsten/phpmyfaq
Packagist thorsten/phpmyfaq · Upgrade to 3.1.11 or later · < 3.1.11 · CVE-2023-0788 · GHSA-r6cw-356h-mvwg
- High, CVSS 7.5
Regular Expression Denial of Service in simple-markdown
npm simple-markdown · Upgrade to 0.5.2 or later · < 0.5.2 · CVE-2019-25103 · GHSA-gpvj-gp8c-c7p2 · amended
- High, CVSS 8.8
Weak Password Requirements in thorsten/phpmyfaq
Packagist thorsten/phpmyfaq · Upgrade to 3.1.11 or later · < 3.1.11 · CVE-2023-0793 · GHSA-fxrq-xhj9-rf5j
- High, CVSS 8.2
Arbitrary code execution in de.tum.in.ase:artemis-java-test-sandbox
Maven de.tum.in.ase:artemis-java-test-sandbox · Upgrade to 1.11.2 or later · < 1.11.2 · CVE-2024-23681 · GHSA-98hq-4wmw-98w9
- Critical, CVSS 9.6
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system
Go github.com/pterodactyl/wings · Upgrade to 1.11.4 or 1.7.4 by release line · < 1.7.4; >= 1.11.0, < 1.11.4 · CVE-2023-25168 · GHSA-66p8-j459-rq63
- Critical, CVSS 9.3
Authentication Bypass in modoboa
PyPI modoboa · Upgrade to 2.0.4 or later · <= 2.0.3 · CVE-2023-0777 · GHSA-rfhw-fm4m-52j6 · amended
- High, CVSS 7.5
IPFS go-unixfsnode subject to DOS via HAMT Decoding Panics
Go github.com/ipfs/go-unixfsnode · Upgrade to 1.5.2 or later · < 1.5.2 · CVE-2023-23631 · GHSA-4gj3-6r43-3wfc
- Critical, CVSS 9.8
CodenameOne Pending Intent vulnerability
Maven com.codenameone:codenameone-core · Upgrade to 7.0.71 or later · < 7.0.71 · CVE-2022-4903 · GHSA-p6xq-9h8r-v544
- Critical, CVSS 9.8
SQL injection in webbuilders-group silverstripe-kapost-bridge
Packagist webbuilders-group/silverstripe-kapost-bridge · Upgrade to 0.4.0 or later · < 0.4.0 · CVE-2015-10077 · GHSA-32gr-x76g-267w
- High, CVSS 7.5
XML External Entity Reference in Apache NiFi
Maven org.apache.nifi:nifi-ccda-processors · Upgrade to 1.20.0 or later · >= 1.2.0, < 1.20.0 · CVE-2023-22832 · GHSA-hxjp-q6c3-38fx
- High, CVSS 8.8
privilege chaining in cockpit-hq/cockpit
Packagist cockpit-hq/cockpit · Upgrade to 2.3.8 or later · < 2.3.8 · CVE-2023-0759 · GHSA-86rf-38v8-9c4x
- High, CVSS 7.5
otelhttp and otelbeego have DoS vulnerability for high cardinality metrics
Go go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego +1 · Upgrade all 2 to 0.39.0 or later · >= 0.38.0, < 0.39.0 · CVE-2023-25151 · GHSA-5r5m-65gx-7vrh
- High, CVSS 7.5
openssl-src vulnerable to Use-after-free following
BIO_new_NDEFcrates.io openssl-src · Upgrade to 300.0.12 or 111.25.0 by release line · < 111.25.0; >= 300.0.0, < 300.0.12 · CVE-2023-0215 · GHSA-r7jw-wp68-3xch
- Critical, CVSS 9.1
openssl-src contains Read Buffer Overflow in X.509 Name Constraint
crates.io openssl-src · Upgrade to 300.0.12 or later · >= 300.0.0, < 300.0.12 · CVE-2022-4203 · GHSA-w67w-mw4j-8qrv
- High, CVSS 7.5
openssl-src subject to Invalid pointer dereference in
d2i_PKCS7functionscrates.io openssl-src · Upgrade to 300.0.12 or later · >= 300.0.0, < 300.0.12 · CVE-2023-0216 · GHSA-29xx-hcv2-c4cp
- High, CVSS 7.5
openssl-src contains Double free after calling
PEM_read_bio_excrates.io openssl-src · Upgrade to 300.0.12 or 111.25.0 by release line · < 111.25.0; >= 300.0.0, < 300.0.12 · CVE-2022-4450 · GHSA-v5w6-wcm8-jm4q
- High, CVSS 7.5
openssl-src subject to NULL dereference validating DSA public key
crates.io openssl-src · Upgrade to 300.0.12 or later · >= 300.0.0, < 300.0.12 · CVE-2023-0217 · GHSA-vxrh-cpg7-8vjr
- High, CVSS 7.5
openssl-src contains
NULLdereference during PKCS7 data verificationcrates.io openssl-src · Upgrade to 300.0.12 or later · >= 300.0.0, < 300.0.12 · CVE-2023-0401 · GHSA-vrh7-x64v-7vxq
- High, CVSS 7.4
Vulnerable OpenSSL included in cryptography wheels
PyPI cryptography · Upgrade to 39.0.1 or later · >= 0.8.1, < 39.0.1 · +1 more package · CVE-2023-0286 · GHSA-x4qr-2fvf-3mr5 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.