High, CVSS 7.1
org.neo4j.procedure:apoc Path Traversal Vulnerability
Maven org.neo4j.procedure:apoc · Upgrade to 4.4.0.12 or 4.3.0.12 by release line · < 4.3.0.12; >= 4.4.0.0, < 4.4.0.12 · CVE-2022-23532 · GHSA-5v8v-gwmw-qw97
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
global-modules-path Command Injection vulnerability
npm global-modules-path · Upgrade to 3.0.0 or later · < 3.0.0 · CVE-2022-21191 · GHSA-vvj3-85vf-fgmw · amended
- High, CVSS 7.4
Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator
Maven org.wildfly.security:wildfly-elytron · Upgrade to 1.20.3.Final or 1.15.15.Final by release line · < 1.15.15.Final; >= 1.16.0.CR1, < 1.20.3.Final · CVE-2022-3143 · GHSA-jmj6-p2j9-68cp
- High, CVSS 7.8
Bloom Uncontrolled Search Path Element vulnerability
Go github.com/bits-and-blooms/bloom · Upgrade to 3.3.1 or later · < 3.3.1 · CVE-2023-0247 · GHSA-fgwp-pwqq-g3w4
- High, CVSS 8.8
RSSHub SSRF vulnerability
npm rsshub · Upgrade to 1.0.0-master.a66cbcf (pre-release) or later · < 1.0.0-master.a66cbcf · CVE-2023-22493 · GHSA-64wp-jh9p-5cg2 · amended
- High, CVSS 8.0
gry vulnerable to Command Injection
npm gry · Upgrade to 6.0.0 or later · < 6.0.0 · CVE-2020-36650 · GHSA-w5mw-f2hq-5fw8 · amended
- High, CVSS 7.5
sviehb/jefferson vulnerable to path traversal
PyPI jefferson · Upgrade to 0.4 or later · < 0.4 · CVE-2022-4885 · GHSA-7jrw-p8jc-v6qw · amended
- High, CVSS 8.1
gatsby-transformer-remark has possible unsanitized JavaScript code injection
npm gatsby-transformer-remark · Upgrade to 6.3.2 or 5.25.1 by release line · >= 6.0.0, < 6.3.2; < 5.25.1 · CVE-2023-22491 · GHSA-7ch4-rr99-cqcw · amended
- High, CVSS 7.5
skeemas Inefficient Regular Expression Complexity vulnerability
npm skeemas · Upgrade to 1.2.5 or later · < 1.2.5 · CVE-2018-25074 · GHSA-qv66-f876-vjvr · amended
- High, CVSS 7.5
.NET Denial of Service Vulnerability
NuGet microsoft.netcore.app.runtime.win-x86 +11 · Upgrade all 12 to 6.0.13 or later · >= 6.0.0, < 6.0.13 · CVE-2023-21538 · GHSA-8f7f-vqg5-jrv9
- High, CVSS 7.7
Flarum post mentions can be used to read any post on the forum without access control
Packagist flarum/mentions · Upgrade to 1.6.3 or later · < 1.6.3 · CVE-2023-22487 · GHSA-22m9-m3ww-53h3
- High, CVSS 7.3
convict vulnerable to Prototype Pollution
npm convict · Upgrade to 6.2.4 or later · < 6.2.4 · CVE-2023-0163 · GHSA-4jrm-c32x-w4jf · amended
- High, CVSS 7.5
bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow
crates.io bzip2 · Upgrade to 0.4.4 or later · < 0.4.4 · CVE-2023-22895 · GHSA-96jv-r488-c2rj
- High, CVSS 7.5
KubePi session fixation attack allows an attacker to hijack a legitimate user session.
Go github.com/KubeOperator/kubepi · Upgrade to 1.6.4 or later · <= 1.6.3 · CVE-2023-22479 · GHSA-v4w5-r2xc-7f8h
- High, CVSS 7.5
KubePi may allow unauthorized access to system API
Go github.com/KubeOperator/kubepi · Upgrade to 1.6.4 or later · <= 1.6.3 · CVE-2023-22478 · GHSA-gqx8-hxmv-c4v4
- High, CVSS 8.0
ruby-git has potential remote code execution vulnerability
RubyGems git · Upgrade to 1.13.0 or later · >= 1.2.0, < 1.13.0 · CVE-2022-46648 · GHSA-pfpr-3463-c6jh
- High, CVSS 7.5
PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash
Packagist pocketmine/pocketmine-mp · Upgrade to 4.8.1 or later · < 4.8.1 · GHSA-wqqv-jcfr-9f5g
- High, CVSS 7.3
Gitops Run insecure communication
Go github.com/weaveworks/weave-gitops · Upgrade to 0.12.0 or later · <= 0.11.0 · CVE-2022-23509 · GHSA-89qm-wcmw-3mgg
- High, CVSS 8.8
GitOps Run allows for Kubernetes workload injection
Go github.com/weaveworks/weave-gitops · Upgrade to 0.12.0 or later · <= 0.11.0 · CVE-2022-23508 · GHSA-wr3c-g326-486c
- High, CVSS 7.5
Luxon Inefficient Regular Expression Complexity vulnerability
npm luxon · Upgrade to 3.2.1, 2.5.2 or 1.28.1 by release line · >= 2.0.0, < 2.5.2; >= 3.0.0, < 3.2.1; >= 1.0.0, < 1.28.1 · CVE-2023-22467 · GHSA-3xq5-wjfh-ppjc · amended
- High, CVSS 7.5
debug Inefficient Regular Expression Complexity vulnerability
npm debug · Upgrade to 3.1.0 or 2.6.9 by release line · < 2.6.9; >= 3.0.0, < 3.1.0 · CVE-2017-20165 · GHSA-9vvw-cc9w-f27h · amended
- Critical, CVSS 9.8
WebPA SQL Injection vulnerability
Packagist webpa/webpa · Upgrade to 3.1.2 or later · < 3.1.2 · CVE-2021-4308 · GHSA-mjgw-f2c4-f8qj
- Critical, CVSS 9.8
PaginationServiceProvider SQL Injection vulnerability
Packagist ttskch/pagination-service-provider · Upgrade to 1.0.0 or later · < 1.0.0 · CVE-2014-125029 · GHSA-ww43-mcvh-35p4
- Critical, CVSS 9.8
Squalor SQL Injection vulnerability
Go github.com/square/squalor · Upgrade to 0.0.0-20200306154055-f6f0a47cc344 (pre-release) or later · < 0.0.0-20200306154055-f6f0a47cc344 · CVE-2020-36645 · GHSA-3hc7-2xcc-7p8f
- Critical, CVSS 9.8
gosqljson SQL Injection vulnerability
Go github.com/elgs/gosqljson · Upgrade to 0.0.0-20220916234230-750f26ee23c7 (pre-release) or later · < 0.0.0-20220916234230-750f26ee23c7 · CVE-2014-125064 · GHSA-g7mw-9pf9-p2pm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.