High, CVSS 7.5
Dompdf allows remote file inclusion because URI validation failure does not halt font registration
Packagist dompdf/dompdf · Upgrade to 2.0.1 or later · < 2.0.1 · CVE-2022-41343 · GHSA-6x28-7h8c-chx4
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.3
rdiffweb vulnerable to account access via session fixation
PyPI rdiffweb · Upgrade to 2.4.7 or later · < 2.4.7 · CVE-2022-3269 · GHSA-j3q4-gmj4-mj95 · amended
- High, CVSS 7.5
Hyperledger Fabric subject to Denial of Service via non-validated request
Go github.com/hyperledger/fabric · Upgrade to 2.4.6 or later · < 2.4.6 · CVE-2022-35253 · GHSA-9w7j-q3xw-p9vh
- Critical, CVSS 9.8
Apache Pinot has Groovy Function support enabled by default
Maven org.apache.pinot:pinot · Upgrade to 0.11.0 or later · < 0.11.0 · CVE-2022-26112 · GHSA-qj9p-jvmw-82rh
- Critical, CVSS 9.8
Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization
Maven org.scala-lang:scala-library · Upgrade to 2.13.9 or later · >= 2.13.0, < 2.13.9 · CVE-2022-36944 · GHSA-8qv5-68g4-248j
- High, CVSS 7.1
HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions
Go github.com/hashicorp/consul · Upgrade to 1.13.2, 1.12.5 or 1.11.9 by release line · >= 1.8.1, < 1.11.9; >= 1.12.0, < 1.12.5; >= 1.13.0, < 1.13.2 · CVE-2021-41803 · GHSA-hr3v-8cp3-68rf
- High, CVSS 7.5
secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery
npm @lionello/secp256k1-js · Upgrade to 1.1.0 or later · < 1.1.0 · CVE-2022-41340 · GHSA-q3f4-9h4p-vgr3 · amended
- High, CVSS 7.5
protobuf-cpp and protobuf-python have potential Denial of Service issue
PyPI protobuf · Upgrade to 4.21.6, 3.20.2, 3.19.5 or 3.18.3 by release line · < 3.18.3; >= 3.19.0, < 3.19.5; >= 3.20.0, < 3.20.2; >= 4.0.0, < 4.21.6 · CVE-2022-1941 · GHSA-8gq9-2x98-w8hf · amended
- Critical, CVSS 9.1
Besu VM vulnerable to gas allocation error in CALL operations
Maven org.hyperledger.besu:evm · Upgrade to 22.7.1 or later · >= 22.4.0-RC1, < 22.7.1 · CVE-2022-36025 · GHSA-4456-w38r-m53x
- Critical, CVSS 9.9
Rancher API and cluster.management.cattle.io object vulnerable to plaintext storage and exposure of credentials
Go github.com/rancher/rancher · Upgrade to 2.6.7 or 2.5.16 by release line · >= 2.5.0, < 2.5.16; >= 2.6.0, < 2.6.7 · CVE-2021-36782 · GHSA-g7j7-h4q8-8w2f
- High, CVSS 7.2
Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console
Maven org.keycloak:keycloak-parent · Upgrade to 19.0.2 or later · < 19.0.2 · CVE-2022-2668 · GHSA-wf7g-7h6h-678v
- Critical, CVSS 9.1
HashiCorp Vault vulnerable to incorrect metadata access
Go github.com/hashicorp/vault · Upgrade to 1.11.3, 1.10.6 or 1.9.9 by release line · >= 1.11.0, < 1.11.3; >= 1.10.0, < 1.10.6; >= 1.8.0, < 1.9.9 · CVE-2022-40186 · GHSA-7cgv-v83v-rr87
- High, CVSS 7.5
Liferay Portal Path Traversal Vulnerability via the Hypermedia REST APIs Module
Maven com.liferay:com.liferay.headless.discovery.web · Upgrade to 4.0.12 or later · < 4.0.12 · CVE-2022-28981 · GHSA-5j86-vmpx-42pc
- High, CVSS 7.5
Apache Batik vulnerable to Server-Side Request Forgery
Maven org.apache.xmlgraphics:batik · Upgrade to 1.15 or later · >= 1.0, < 1.15 · CVE-2022-40146 · GHSA-h4qg-p7r2-cpg3
- High, CVSS 7.1
rdiffweb Cross-Site Request Forgery vulnerability can lead to user email ID being changed
PyPI rdiffweb · Upgrade to 2.4.7 or later · < 2.4.7 · CVE-2022-3274 · GHSA-gmj8-84r4-h46j · amended
- High, CVSS 8.7
Apache Airflow vulnerable to Use of Externally-Controlled Format String
PyPI apache-airflow · Upgrade to 2.4.0rc1 (pre-release) or later · >= 2.3.0, < 2.4.0rc1 · CVE-2022-40604 · GHSA-5rp4-749p-vx26 · amended
- High, CVSS 8.7
OctoPrint Improper Privilege Management vulnerability
PyPI octoprint · Upgrade to 1.8.3 or later · < 1.8.3 · CVE-2022-3068 · GHSA-2p75-q37p-f852 · amended
- High, CVSS 8.0
Jenkins Anchore Container Image Scanner Plugin vulnerable to cross site scripting
Maven org.jenkins-ci.plugins:anchore-container-scanner · Upgrade to 1.0.25 or later · <= 1.0.24 · CVE-2022-41225 · GHSA-f2j5-w76m-3rqh
- High, CVSS 8.0
Jenkins vulnerable to stored cross site scripting in the I:helpIcon component
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.370 or later · >= 2.367, < 2.370 · CVE-2022-41224 · GHSA-xpvp-h73c-m9rq
- High, CVSS 8.0
Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Cross-site Scripting
Maven io.jenkins.plugins:cavisson-ns-nd-integration · Upgrade to 4.8.0.147 or later · < 4.8.0.147 · CVE-2022-41229 · GHSA-fq2h-r2h9-pj8r
- High, CVSS 7.1
Jenkins Compuware Common Configuration Plugin vulnerable to Improper Restriction of XML External Entity Reference
Maven com.compuware.jenkins:compuware-common-configuration · Upgrade to 1.0.15 or later · <= 1.0.14 · CVE-2022-41226 · GHSA-g43x-pcc9-f472
- Critical, CVSS 9.3
python-jwt vulnerable to token forgery with new claims
PyPI python-jwt · Upgrade to 3.3.4 or later · < 3.3.4 · CVE-2022-39227 · GHSA-5p8v-58qm-c7fp · amended
- High, CVSS 7.0
arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm.
RubyGems arr-pm · Upgrade to 0.0.12 or later · < 0.0.12 · CVE-2022-39224 · GHSA-88cv-mj24-8w3q
- High, CVSS 7.5
Apache Kafka vulnerability can lead to brokers hitting OutOfMemoryException, causing Denial of Service
Maven org.apache.kafka:kafka · Upgrade to 3.2.3, 3.1.2, 3.0.2 or 2.8.2 by release line · >= 2.8.0, < 2.8.2; >= 3.0.0, < 3.0.2; >= 3.1.0, < 3.1.2; >= 3.2.0, < 3.2.3 · CVE-2022-34917 · GHSA-c9h3-c6qj-hh7q
- High, CVSS 8.8
Apache InLong vulnerable to Deserialization of Untrusted Data
Maven org.apache.inlong:inlong-common · Upgrade to 1.3.0 or later · < 1.3.0 · CVE-2022-40955 · GHSA-26m4-qjp9-xmc6
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.