High, CVSS 7.5
Inefficient Regular Expression Complexity in Loofah
RubyGems loofah · Upgrade to 2.19.1 or later · < 2.19.1 · CVE-2022-23514 · GHSA-486f-hjj9-9vhh
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.5
TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework
Packagist typo3/cms · Upgrade to 12.1.1, 11.5.20 or 10.4.33 by release line · >= 10.0.0, < 10.4.33; >= 11.0.0, < 11.5.20; >= 12.0.0, < 12.1.1 · +1 more package · CVE-2022-23503 · GHSA-c5wx-6c2c-f7rm
- High, CVSS 7.5
Apache CXF vulnerable to Exposure of Sensitive Information
Maven org.apache.cxf:cxf-core · Upgrade to 3.5.5 or 3.4.10 by release line · < 3.4.10; >= 3.5.0, < 3.5.5 · CVE-2022-46363 · GHSA-3w37-5p3p-jv92
- High, CVSS 7.5
Jettison Out-of-bounds Write vulnerability
Maven org.codehaus.jettison:jettison · Upgrade to 1.5.2 or later · < 1.5.2 · CVE-2022-45693 · GHSA-grr4-wv38-f68w
- High, CVSS 7.5
Jettison Out-of-bounds Write vulnerability
Maven org.codehaus.jettison:jettison · Upgrade to 1.5.2 or later · < 1.5.2 · CVE-2022-45685 · GHSA-7rf3-mqpx-h7xg
- High, CVSS 7.5
json stack overflow vulnerability
Maven org.json:json · Upgrade to 20230227 or later · < 20230227 · +1 more package · CVE-2022-45688 · GHSA-3vqj-43w4-2q58
- High, CVSS 7.7
@cubejs-backend/api-gateway row level security bypass
npm @cubejs-backend/api-gateway · Upgrade to 0.31.24 or later · >= 0.31.23, <= 0.31.23 · CVE-2022-23510 · GHSA-6jqm-3c9g-pch7 · amended
- High, CVSS 8.3
SnakeYaml Constructor Deserialization Remote Code Execution
Maven org.yaml:snakeyaml · Upgrade to 2.0 or later · <= 1.33 · CVE-2022-1471 · GHSA-mjmj-j48q-9wg2
- Critical, CVSS 9.3
Improper Privilege Management in rdiffweb
PyPI rdiffweb · Upgrade to 2.5.2 or later · < 2.5.2 · CVE-2022-4314 · GHSA-g594-55mp-f6q8 · amended
- High, CVSS 7.5
Protobuf Java vulnerable to Uncontrolled Resource Consumption
Maven com.google.protobuf:protobuf-java +1 · Upgrade all 2 to 3.21.7, 3.20.3, 3.19.6 or 3.16.3 by release line · >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3 · CVE-2022-3510 · GHSA-4gg5-vx3j-xwc7
- High, CVSS 7.5
Protobuf Java vulnerable to Uncontrolled Resource Consumption
Maven com.google.protobuf:protobuf-java · Upgrade to 3.21.7, 3.20.3, 3.19.6 or 3.16.3 by release line · >= 3.17.0, < 3.19.6; >= 3.20.0, < 3.20.3; >= 3.21.0, < 3.21.7; >= 3.0.0, < 3.16.3 · +1 more package · CVE-2022-3509 · GHSA-g5ww-5jh7-63cx
- High, CVSS 8.8
AList vulnerable to Improper Preservation of Permissions
Go github.com/alist-org/alist/v3 · Upgrade to 3.5.1 or later · < 3.5.1 · CVE-2022-45968 · GHSA-4gjr-vgfx-9qvw
- High, CVSS 7.1
Amazon CloudWatch Agent for Windows has Privilege Escalation Vector
Go github.com/aws/amazon-cloudwatch-agent · Upgrade to 1.247355.0 or later · < 1.247355.0 · CVE-2022-23511 · GHSA-j8x2-2m5w-j939
- High, CVSS 7.1
Jenkins Plot Plugin XML External Entity Reference vulnerability
Maven org.jenkins-ci.plugins:plot · Upgrade to 2.1.12 or later · < 2.1.12 · CVE-2022-46682 · GHSA-wgpp-g6v9-7hxp
- High, CVSS 7.5
Stored XSS vulnerability in Jenkins Checkmarx Plugin
Maven com.checkmarx.jenkins:checkmarx · Upgrade to 2022.4.3 or later · <= 2022.3.3 · CVE-2022-46684 · GHSA-p86x-75j8-w4xh
- High, CVSS 8.0
Cross-site Scripting in Jenkins Spring Config Plugin
Maven io.jenkins.plugins:spring-config · Upgrade to 2.0.1 or later · < 2.0.1 · CVE-2022-46687 · GHSA-3rrx-364r-6wf6
- High, CVSS 8.0
Jenkins Custom Build Properties Plugin vulnerable to Cross-site Scripting
Maven io.jenkins.plugins:custom-build-properties · Upgrade to 2.82.v16d5b (pre-release) or later · < 2.82.v16d5b · CVE-2022-46686 · GHSA-5g2c-j6v9-vf94
- High, CVSS 7.5
phpMyFAQ has insecure HTTP cookies
Packagist thorsten/phpmyfaq · Upgrade to 3.1.9 or later · < 3.1.9 · CVE-2022-4409 · GHSA-wpgc-5cr5-h9gg
- High, CVSS 8.0
Spring Boot Admins integrated notifier support allows arbitrary code execution
Maven de.codecentric:spring-boot-admin · Upgrade to 3.0.0-M6 (pre-release), 2.7.8 or 2.6.10 by release line · < 2.6.10; >= 2.7.0, < 2.7.8; >= 3.0.0-M1, < 3.0.0-M6 · CVE-2022-46166 · GHSA-w3x5-427h-wfq6
- High, CVSS 8.8
Akeneo PIM Community Edition vulnerable to remote php code execution
Packagist akeneo/pim-community-dev · Upgrade to 6.0.53 or 5.0.119 by release line · >= 6.0.0, < 6.0.53; < 5.0.119 · CVE-2022-46157 · GHSA-w9wc-4xcq-8gr6
- Critical, CVSS 9.8
Mingsoft MCMS vulnerable to SQL Injection
Maven net.mingsoft:ms-mcms · Upgrade to 5.2.10 or later · <= 5.2.9 · CVE-2022-4375 · GHSA-hc5g-xf64-j49j
- High, CVSS 7.5
go-merkledag's ProtoNode may be modified such that common method calls may panic
Go github.com/ipfs/go-merkledag · Upgrade to 0.8.1 or later · >= 0.4.0, < 0.8.1 · CVE-2022-23495 · GHSA-x39j-h85h-3f46
- High, CVSS 8.6
Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List
Maven nl.basjes.parse.useragent:yauaa +11 · Upgrade all 12 to 7.9.0 or later · >= 7.0.0, < 7.9.0 · CVE-2022-23496 · GHSA-c4pm-63cg-9j7h
- High, CVSS 7.5
Unchecked return value from xmlTextReaderExpand
RubyGems nokogiri · Upgrade to 1.13.10 or later · >= 1.13.8, < 1.13.10 · CVE-2022-23476 · GHSA-qv4q-mr5r-qprj
- High, CVSS 7.5
libp2p DoS vulnerability from lack of resource management
npm libp2p · Upgrade to 0.38.0 or later · < 0.38.0 · CVE-2022-23487 · GHSA-f44q-634c-jvwv · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.