Critical, CVSS 9.9
acryl-datahub missing JWT signature check
PyPI acryl-datahub · Upgrade to 0.8.45 or later · < 0.8.45 · CVE-2022-39366 · GHSA-r8gm-v65f-c973 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
thlorenz browserify-shim vulnerable to prototype pollution
npm browserify-shim · Upgrade to 3.8.16 or later · <= 3.8.15 · CVE-2022-37623 · GHSA-cfgr-75jx-h88g · amended
- High, CVSS 7.5
conduit-hyper vulnerable to Denial of Service from unchecked request length
crates.io conduit-hyper · Upgrade to 0.4.2 or later · >= 0.2.0-alpha.3, < 0.4.2 · CVE-2022-39294 · GHSA-9398-5ghf-7pr6
- Critical, CVSS 9.8
phpMyFAQ contains Weak Password Requirements
Packagist thorsten/phpmyfaq · Upgrade to 3.1.8 or later · < 3.1.8 · CVE-2022-3754 · GHSA-2rr3-rv49-p42f
- Critical, CVSS 9.8
thlorenz browserify-shim vulnerable to prototype pollution
npm browserify-shim · Upgrade to 3.8.16 or later · <= 3.8.15 · CVE-2022-37621 · GHSA-r737-347m-wqc7 · amended
- Critical, CVSS 9.8
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
Packagist pimcore/pimcore · Upgrade to 10.5.9 or later · < 10.5.9 · CVE-2022-39365 · GHSA-5qxq-vgmm-q39m
- High, CVSS 8.2
Keylime: unhandled exceptions could lead to invalid attestation states
PyPI keylime · Upgrade to 6.5.1 or later · < 6.5.1 · CVE-2022-3500 · GHSA-hff2-x2j9-gxgv · amended
- High, CVSS 7.5
Ansible leaks password to logs
PyPI ansible · Upgrade to 7.0.0 or later · >= 2.5.0, < 7.0.0 · CVE-2022-3697 · GHSA-cpx3-93w7-457x · amended
- High, CVSS 8.1
Prototype pollution in Snowboard framework
Packagist wintercms/winter · Upgrade to 1.2.1 or 1.1.10 by release line · >= 1.1.8, < 1.1.10; >= 1.2.0, < 1.2.1 · CVE-2022-39357 · GHSA-3fh5-q6fg-w28q
- Critical, CVSS 9.3
Rdiffweb subject to Business Logic Errors
PyPI rdiffweb · Upgrade to 2.5.0a7 (pre-release) or later · < 2.5.0a7 · CVE-2022-3363 · GHSA-jw36-mrvg-j5fx · amended
- High, CVSS 8.7
Execution with Unnecessary Privileges in JupyterApp
PyPI jupyter-core · Upgrade to 4.11.2 or later · < 4.11.2 · CVE-2022-39286 · GHSA-m678-f26j-3hrp · amended
- High, CVSS 8.7
Apache IoTDB subject to ReDOS with Java 8
Maven org.apache.iotdb:flink-tsfile-connector +3 · Upgrade all 4 to 0.13.3 or later · >= 0.12.2, < 0.13.3 · CVE-2022-43766 · GHSA-g6hg-4v3c-6jq7 · amended
- Critical, CVSS 9.8
Apache Flume vulnerable to remote code execution via deserialization of unsafe providerURL
Maven org.apache.flume.flume-ng-sources:flume-jms-source · Upgrade to 1.11.0 or later · < 1.11.0 · CVE-2022-42468 · GHSA-9w4g-fp9h-3q2v
- High, CVSS 8.8
Apache Linkis subject to Remote Code Execution via deserialization
Maven org.apache.linkis:linkis · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2022-39944 · GHSA-3f3w-gmqf-4hj3
- Critical, CVSS 9.8
Badaso vulnerable to Remote Code Execution via malicious file upload
Packagist badaso/core · Upgrade to 2.6.1 or later · < 2.6.1 · CVE-2022-41711 · GHSA-fwvc-9xhj-26v5
- Critical, CVSS 9.8
feathers-sequelize vulnerable to SQL injection due to improper parameter filtering
npm feathers-sequelize · Upgrade to 6.3.4 or later · >= 6.0.0, < 6.3.4 · CVE-2022-29822 · GHSA-5hq7-j5wq-p227 · amended
- Critical, CVSS 9.8
Insufficient validation when decoding a Socket.IO packet
npm socket.io-parser · Upgrade to 4.2.1, 4.0.5, 3.4.2 or 3.3.3 by release line · >= 4.1.0, < 4.2.1; >= 4.0.0, < 4.0.5; < 3.3.3; >= 3.4.0, < 3.4.2 · CVE-2022-2421 · GHSA-qm95-pgcg-qqfq · amended
- Critical, CVSS 9.8
Feather-Sequelize cleanQuery method vulnerable to Prototype Pollution
npm feathers-sequelize · Upgrade to 6.3.3 or later · >= 6.0.0, < 6.3.3 · CVE-2022-29823 · GHSA-p5m3-27vh-52j4 · amended
- Critical, CVSS 9.8
feathers-sequelize contains improper input validation leading to SQL injection
npm feathers-sequelize · Upgrade to 6.3.4 or later · >= 6.0.0, < 6.3.4 · CVE-2022-2422 · GHSA-qpv8-4pjq-qqh7 · amended
- High, CVSS 7.5
Inefficient Regular Expression Complexity in shescape
npm shescape · Upgrade to 1.6.1 or later · >= 1.5.10, < 1.6.1 · CVE-2022-25918 · GHSA-cr84-xvw4-qx3c · amended
- Critical, CVSS 9.8
Gin-vue-admin subject to Remote Code Execution via file upload vulnerability
Go github.com/flipped-aurora/gin-vue-admin/server · Upgrade to 2.5.4 or later · < 2.5.4 · CVE-2022-39345 · GHSA-7gc4-r5jr-9hxv
- Critical, CVSS 9.8
Skipper vulnerable to SSRF via X-Skipper-Proxy
Go github.com/zalando/skipper · Upgrade to 0.13.237 or later · < 0.13.237 · CVE-2022-38580 · GHSA-f2rj-m42r-6jm2
- High, CVSS 8.1
Improper Control of Generation of Code ('Code Injection') in Azure CLI
PyPI azure-cli · Upgrade to 2.40.0 or later · < 2.40.0 · CVE-2022-39327 · GHSA-47xc-9rr2-q7p4 · amended
- High, CVSS 7.5
Untrusted code execution in Apache XML Graphics Batik
Maven org.apache.xmlgraphics:batik +1 · Upgrade all 2 to 1.16 or later · < 1.16 · CVE-2022-42890 · GHSA-rwqr-m72q-v6cm
- High, CVSS 7.5
Apache XML Graphics Batik vulnerable to code execution via SVG.
Maven org.apache.xmlgraphics:batik · Upgrade to 1.16 or later · < 1.16 · CVE-2022-41704 · GHSA-r29w-r9ph-vm76
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.