Critical, CVSS 9.8
Baobab vulnerable to Prototype Pollution
npm baobab · Upgrade to 2.6.1 or later · < 2.6.1 · CVE-2021-4307 · GHSA-wvr2-q86m-6whp · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference
Packagist kelvinmo/simplexrd · Upgrade to 3.1.1 or later · < 3.1.1 · CVE-2015-10029 · GHSA-rh3m-pr36-xh2f
- High, CVSS 7.5
terminal-kit Inefficient Regular Expression Complexity vulnerability
npm terminal-kit · Upgrade to 2.1.8 or later · < 2.1.8 · CVE-2021-4306 · GHSA-wxgh-8gmr-3qh3 · amended
- Critical, CVSS 9.8
globalpom-utils has Insecure Temporary File
Maven com.anrisoftware.globalpom:globalpomutils · Upgrade to 4.5.1 or later · < 4.5.1 · CVE-2018-25068 · GHSA-jjvp-wfp8-rv69
- Critical, CVSS 9.8
himiklab yii2-jqgrid-widget vulnerable to SQL Injection
Packagist himiklab/yii2-jqgrid-widget · Upgrade to 1.0.8 or later · < 1.0.8 · CVE-2014-125051 · GHSA-7mg5-rw39-q67f
- Critical, CVSS 9.8
KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys
Go github.com/KubeOperator/kubepi · Upgrade to 1.6.3 or later · <= 1.6.2 · CVE-2023-22463 · GHSA-vjhf-8vqx-vqpq
- Critical, CVSS 9.0
XWiki CKEditor.HTMLConverter vulnerable to Remote Code Execution via Cross-Site Request Forgery
Maven org.xwiki.contrib:application-ckeditor-ui · Upgrade to 1.64.3 or later · < 1.64.3 · CVE-2023-22457 · GHSA-6mjp-2rm6-9g85
- Critical, CVSS 9.8
DBRisinajumi d2files SQL Injection vulnerability
Packagist dbrisinajumi/d2files · Upgrade to 1.0.0 or later · < 1.0.0 · CVE-2015-10018 · GHSA-68hv-8926-j34c
- Critical, CVSS 9.8
nodebatis SQL Injection vulnerability
npm nodebatis · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2018-25066 · GHSA-8ph8-9q2j-c3rq · amended
- Critical, CVSS 9.8
dssp vulnerable to Improper Restriction of XML External Entity Reference
Maven be.e_contract.dssp:dssp-client · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2016-15011 · GHSA-77cc-w3wm-6whp
- Critical, CVSS 9.8
exec-local-bin vulnerable to Command Injection
npm exec-local-bin · Upgrade to 1.2.0 or later · < 1.2.0 · CVE-2022-25923 · GHSA-f259-h6m8-hm8m · amended
- Critical, CVSS 9.8
bonita-connector-webservice XML External Entity vulnerability
Maven org.bonitasoft.connectors:bonita-connector-webservice · Upgrade to 1.3.1 or later · < 1.3.1 · CVE-2020-36640 · GHSA-wg99-5vrx-j2gg
- Critical, CVSS 9.8
aXMLRPC XML External Entity vulnerability
Maven fr.turri:aXMLRPC · Upgrade to 1.12.1 or later · < 1.12.1 · CVE-2020-36641 · GHSA-g4r8-28fp-f255
- High, CVSS 7.5
robots-txt-guard Inefficient Regular Expression Complexity vulnerability
npm robots-txt-guard · Upgrade to 1.0.2 or later · < 1.0.2 · CVE-2021-4305 · GHSA-6g33-8w2q-4hxv · amended
- High, CVSS 7.6
@mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS)
npm @mattkrick/sanitize-svg · Upgrade to 0.4.0 or later · <= 0.3.1 · CVE-2023-22461 · GHSA-h857-2g56-468g · amended
- High, CVSS 7.5
PgHero Allows Information Disclosure Through EXPLAIN Feature
RubyGems pghero · Upgrade to 3.1.0 or later · < 3.1.0 · CVE-2023-22626 · GHSA-vf99-xw26-86g5
- High, CVSS 7.5
Uniswap Universal Router Incorrect Authorization vulnerability
npm @uniswap/universal-router · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2022-48216 · GHSA-7m37-cx35-qgmr · amended
- High, CVSS 7.8
window-control vulnerable to Command Injection due to improper input sanitization
npm window-control · Upgrade to 1.4.5 or later · < 1.4.5 · CVE-2022-25926 · GHSA-9mjx-wfqp-j5ph · amended
- Critical, CVSS 9.3
Apache DolphinScheduler vulnerable to Improper Input Validation
Maven org.apache.dolphinscheduler:dolphinscheduler · Upgrade to 3.1.1 or 3.0.2 by release line · < 3.0.2; >= 3.1.0, <= 3.1.0 · +1 more package · CVE-2022-45875 · GHSA-3xh5-8hvq-rc8x · amended
- High, CVSS 8.6
Gravitee API Management contains Path Traversal
Maven io.gravitee.apim:gravitee-api-management · Upgrade to 3.15.13 or later · < 3.15.13 · CVE-2022-38723 · GHSA-vp62-m958-qj8c
- High, CVSS 7.5
Apache Tomcat improperly escapes input from JsonErrorReportValve
Maven org.apache.tomcat:tomcat-catalina · Upgrade to 10.1.2 or later · >= 10.1.0, <= 10.1.1 · +2 more packages · CVE-2022-45143 · GHSA-rq2w-37h9-vg94
- Critical, CVSS 9.8
Apache Dubbo vulnerable to remote code execution via Telnet Handler
Maven org.apache.dubbo:dubbo-parent · Upgrade to 2.7.10 or 2.6.10 by release line · < 2.6.10; >= 2.7.0, < 2.7.10 · CVE-2021-32824 · GHSA-fprr-rrm8-4534
- High, CVSS 7.1
Apiman has potential permissions bypass
Maven io.apiman:apiman-manager-api-rest-impl · Upgrade to 3.0.0.Final or later · >= 1.5.7, <= 2.2.3.Final · CVE-2022-47551 · GHSA-j94p-hv25-rm5g
- High, CVSS 7.5
FrameworkUserBundle Generates Error Message Containing Sensitive Information
Packagist sumocoders/framework-user-bundle · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2015-10012 · GHSA-6m7c-45ff-3328
- Critical, CVSS 9.8
nterchange Code Injection vulnerability
Packagist nonfiction/nterchange · Upgrade to 4.1.1 or later · < 4.1.1 · CVE-2015-10009 · GHSA-cp2p-6xh4-jmcp
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.