High, CVSS 7.5
Switcher Client contains Regular Expression Denial of Service (ReDoS)
npm switcher-client · Upgrade to 3.1.4 or later · < 3.1.4 · CVE-2023-23925 · GHSA-wqxw-8h5g-hq56 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.6
AVideo contains Command injection when embedding a video link
Packagist wwbn/avideo · Upgrade to 12.4 or later · < 12.4 · CVE-2023-25313 · GHSA-pgvh-p3g4-86jw
- High, CVSS 8.7
Django contains Uncontrolled Resource Consumption via cached header
PyPI django · Upgrade to 4.1.6, 4.0.9 or 3.2.17 by release line · >= 3.2a1, < 3.2.17; >= 4.0a1, < 4.0.9; >= 4.1a1, < 4.1.6 · CVE-2023-23969 · GHSA-q2jf-h9jm-m7p4 · amended
- High, CVSS 7.8
mt7688-wiscan is vulnerable to Command Injection due to improper input sanitization
npm mt7688-wiscan · Upgrade to 0.8.3 or later · < 0.8.3 · CVE-2022-25916 · GHSA-5h8c-8ccp-8gmh · amended
- Critical, CVSS 10.0
Dompdf vulnerable to URI validation failure on SVG parsing
Packagist dompdf/dompdf · Upgrade to 2.0.2 or later · < 2.0.2 · CVE-2023-23924 · GHSA-3cw5-7cxw-v5qg
- High, CVSS 8.6
XSS Attack with Express API
npm eta · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2023-23630 · GHSA-xrh7-m5pp-39r6 · amended
- High, CVSS 8.7
Parse Server option
masterKeyIpsvulnerability to IP spoofingnpm parse-server · Upgrade to 5.4.1 or later · < 5.4.1 · CVE-2023-22474 · GHSA-vm5r-c87r-pf6x · amended
- Critical, CVSS 9.8
Dromara hutool vulnerable to SQL Injection
Maven cn.hutool:hutool-all · Upgrade to 5.8.21 or later · < 5.8.21 · CVE-2023-24163 · GHSA-6c25-cxcc-pmc4
- High, CVSS 8.8
Apache Linkis contains Deserialization of Untrusted Data
Maven org.apache.linkis:linkis · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2022-44645 · GHSA-h6w8-52mq-4qxc
- High, CVSS 7.5
http-cache-semantics vulnerable to Regular Expression Denial of Service
Maven org.webjars.npm:http-cache-semantics +1 · Upgrade all 2 to 4.1.1 or later · < 4.1.1 · CVE-2022-25881 · GHSA-rc47-6667-2j5j · amended
- Critical, CVSS 9.8
nemo-appium vulnerable to OS Command Injection
npm nemo-appium · Upgrade to 0.0.9 or later · < 0.0.9 · CVE-2022-21129 · GHSA-c6rx-gxqv-vr5j · amended
- High, CVSS 8.8
Eta vulnerable to Code Injection via templates rendered with user-defined data
npm eta · Upgrade to 2.0.0 or later · < 2.0.0 · CVE-2022-25967 · GHSA-mf6x-hrgr-658f · amended
- High, CVSS 7.5
Servst vulnerable to Path Traversal
npm servst · Upgrade to 2.0.3 or later · < 2.0.3 · CVE-2022-25936 · GHSA-88v8-v46g-6c9w · amended
- High, CVSS 7.5
Paranoidhttp Server-Side Request Forgery vulnerability
Go github.com/hakobe/paranoidhttp · Upgrade to 0.3.0 or later · < 0.3.0 · CVE-2023-24623 · GHSA-v9mp-j8g7-2q6m
- High, CVSS 7.5
Froxlor contains Weak Password Requirements
Packagist froxlor/froxlor · Upgrade to 2.0.10 or later · < 2.0.10 · CVE-2023-0564 · GHSA-pm72-27mg-fc28
- High, CVSS 8.7
NYUCCL psiTurk IS vulnerable to Improper Neutralization of Special Elements
PyPI psiturk · Upgrade to 3.2.1 or later · < 3.2.1 · CVE-2021-4315 · GHSA-9mq4-9556-6qxq · amended
- High, CVSS 7.2
DataFlow upload remote code execution vulnerability
Packagist openmage/magento-lts · Upgrade to 20.0.19 or 19.4.22 by release line · < 19.4.22; >= 20.0.0, < 20.0.19 · CVE-2021-41231 · GHSA-h632-p764-pjqm
- High, CVSS 8.8
Fix for authenticated remote code execution through layout update
Packagist openmage/magento-lts · Upgrade to 20.0.19 or 19.4.22 by release line · < 19.4.22; >= 20.0.0, < 20.0.19 · CVE-2021-41144 · GHSA-5j2g-3ph4-rgvm
- High, CVSS 7.2
Fix for arbitrary file deletion in customer media allows for remote code execution
Packagist openmage/magento-lts · Upgrade to 20.0.19 or 19.4.22 by release line · < 19.4.22; >= 20.0.0, < 20.0.19 · CVE-2021-41143 · GHSA-5vpv-xmcj-9q85
- High, CVSS 7.2
Fix for arbitrary command execution in custom layout update through blocks
Packagist openmage/magento-lts · Upgrade to 20.0.19 or 19.4.22 by release line · < 19.4.22; >= 20.0.0, < 20.0.19 · CVE-2021-39217 · GHSA-c9q3-r4rv-mjm7
- High, CVSS 7.4
Improper Certificate Validation in pyload-ng
PyPI pyload-ng · Upgrade to 0.5.0b3.dev44 (pre-release) or later · < 0.5.0b3.dev44 · CVE-2023-0509 · GHSA-8v53-23mx-hcf9 · amended
- High, CVSS 7.5
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie
RubyGems devise · Upgrade to 3.5.4 or later · < 3.5.4 · CVE-2015-8314 · GHSA-746g-3gfp-hfhw
- Critical, CVSS 9.8
phpmyadmin contains SQL Injection vulnerability
Packagist phpmyadmin/phpmyadmin · Upgrade to 5.0.2 or later · >= 5.0.0, < 5.0.2 · CVE-2020-22452 · GHSA-prcg-mc23-hgjh
- Critical, CVSS 9.8
Remote code execution in simple-git
npm simple-git · Upgrade to 3.16.0 or later · < 3.16.0 · CVE-2022-25860 · GHSA-9w5j-4mwv-2wj8 · amended
- High, CVSS 8.7
Directory Traversal in onnx
PyPI onnx · Upgrade to 1.13.0 or later · < 1.13.0 · CVE-2022-25882 · GHSA-ffxj-547x-5j7c · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.