High, CVSS 7.5
graphql-java vulnerable to Denial of Service via GraphQL query that consumes CPU resources
Maven com.graphql-java:graphql-java · Upgrade to 18.3 or 17.4 by release line · < 17.4; >= 18.0, < 18.3 · CVE-2022-37734 · GHSA-v62j-cxhh-fq22
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
Apache Calcite before 1.32.0 vulnerable to potential XML External Entity (XXE) attack
Maven org.apache.calcite:calcite-core · Upgrade to 1.32.0 or later · >= 1.22.0, < 1.32.0 · CVE-2022-39135 · GHSA-fj2m-w3wv-x9pr
- High, CVSS 8.8
Goomph before 3.37.2 allows malicious zip file to write contents to arbitrary locations
Maven com.diffplug.gradle:goomph · Upgrade to 3.37.2 or later · < 3.37.2 · CVE-2022-26049 · GHSA-p2f7-9cv7-jjf6
- Critical, CVSS 9.8
PDFKit vulnerable to Command Injection
RubyGems pdfkit · Upgrade to 0.8.7.2 or later · < 0.8.7.2 · CVE-2022-25765 · GHSA-rhwx-hjx2-x4qr
- Critical, CVSS 9.8
com.google.cloud.tools:jib-core vulnerable to Remote Code Execution (RCE)
Maven com.google.cloud.tools:jib-core · Upgrade to 0.22.0 or later · < 0.22.0 · CVE-2022-25914 · GHSA-936v-cg49-m2g5
- High, CVSS 7.5
Apache James vulnerable to buffering attack
Maven org.apache.james:james-server · Upgrade to 3.7.1 or 3.6.3 by release line · < 3.6.3; >= 3.7.0, <= 3.7.0 · CVE-2022-28220 · GHSA-w45j-f5g5-w94x
- Critical, CVSS 9.3
rdiffweb vulnerable to Improper Restriction of Rendered UI Layers or Frames
PyPI rdiffweb · Upgrade to 2.4.1 or later · < 2.4.1 · CVE-2022-3167 · GHSA-m379-x4xc-38x9 · amended
- High, CVSS 8.1
RosarioSIS before 10.1 vulnerable to Improper Handling of Length Parameter Inconsistency
Packagist francoisjacquet/rosariosis · Upgrade to 10.1 or later · < 10.1 · CVE-2022-2714 · GHSA-vh4m-mw8w-g4w8
- High, CVSS 8.1
Barbican authorization flaw before v14.0.0
PyPI barbican · Upgrade to 14.0.0 or later · < 14.0.0 · CVE-2022-23451 · GHSA-p2jg-q8hw-p7gc · amended
- High, CVSS 7.5
x/crypto/ssh vulnerable to panic via malformed packets
Go golang.org/x/crypto · Upgrade to 0.0.0-20211202192323-5770296d904e (pre-release) or later · < 0.0.0-20211202192323-5770296d904e · CVE-2021-43565 · GHSA-gwc9-m7rh-j2ww
- High, CVSS 7.5
golang.org/x/net/http2 Denial of Service vulnerability
Go golang.org/x/net/http2 +1 · Upgrade all 2 to 0.0.0-20220906165146-f3363e06e74c (pre-release) or later · < 0.0.0-20220906165146-f3363e06e74c · CVE-2022-27664 · GHSA-69cg-p879-7622
- Critical, CVSS 9.8
FeehiCMS has an arbitrary file upload vulnerability
Packagist feehi/cms · Upgrade to 2.0.8.1 or later · < 2.0.8.1 · CVE-2020-21516 · GHSA-jj62-mc3m-j769
- Critical, CVSS 9.8
Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameter
Maven org.gluu:oxauth-common · Upgrade to 4.4.1 or later · < 4.4.1 · CVE-2022-36663 · GHSA-hc94-9v26-gxwv
- High, CVSS 7.5
Apache IoTDB grafana-connector contains an interface without authorization
Maven org.apache.iotdb:iotdb-grafana-connector · Upgrade to 0.13.1 or later · < 0.13.1 · CVE-2022-38370 · GHSA-c86f-9grv-pmqf
- Critical, CVSS 9.3
Apache Airflow Session Fixation vulnerability
PyPI apache-airflow · Upgrade to 2.3.4rc1 (pre-release) or later · >= 2.2.4, < 2.3.4rc1 · CVE-2022-38054 · GHSA-5ff8-7639-6v6g · amended
- High, CVSS 7.1
Indy's NODE_UPGRADE transaction vulnerable to remote code execution
PyPI indy-node · Upgrade to 1.12.5rc1 (pre-release) or later · < 1.12.5rc1 · CVE-2022-31020 · GHSA-r6v9-p59m-gj2p · amended
- High, CVSS 8.8
Apache ShenYu Admin has insecure permissions
Maven org.apache.shenyu:shenyu-common · Upgrade to 2.5.0 or later · >= 2.4.2, <= 2.4.3 · CVE-2022-37435 · GHSA-fjjw-82xw-vfc2
- Critical, CVSS 9.1
python-scciclient vulnerable to Man-in-the-middle (MITM) attacks
PyPI python-scciclient · Upgrade to 0.12.0 or later · < 0.12.0 · CVE-2022-2996 · GHSA-rf3f-3p37-2qh4 · amended
- Critical, CVSS 9.8
lz4-sys vulnerable to memory corruption via issue in liblz4
crates.io lz4-sys · Upgrade to 1.9.4 or later · < 1.9.4 · GHSA-9q5j-jm53-v7vr
- High, CVSS 7.5
elrond-go MultiESDTNFTTransfer call on a SC address with missing function name
Go github.com/ElrondNetwork/elrond-go · Upgrade to 1.3.34 or later · <= 1.3.33 · CVE-2022-36058 · GHSA-qf7j-25g9-r63f
- High, CVSS 7.7
Flux CLI Workload Injection
Go github.com/fluxcd/flux2 · Upgrade to 0.32.0 or later · >= 0.21.0, < 0.32.0 · CVE-2022-36035 · GHSA-xwf3-6rgv-939r
- Critical, CVSS 9.8
Apache Geode vulnerable to Deserialization of Untrusted Data
Maven org.apache.geode:geode-core · Upgrade to 1.14.1, 1.13.5 or 1.12.16 by release line · < 1.12.16; >= 1.13.0, < 1.13.5; >= 1.14.0, < 1.14.1 · CVE-2022-37021 · GHSA-q4q3-r45f-7gwg
- High, CVSS 8.8
Apache Geode versions deserialization of untrusted datawhen using JMX over RMI on Java 11
Maven org.apache.geode:geode-core · Upgrade to 1.15.0 or later · < 1.15.0 · CVE-2022-37022 · GHSA-qf8g-vpwp-6579
- Critical, CVSS 9.8
Quarkus does not terminate HTTP requests header context
Maven io.quarkus:quarkus-core-parent · Upgrade to 2.10.4 or later · >= 2.10.0, < 2.10.4 · CVE-2022-2466 · GHSA-mwhw-6p27-4crc
- Critical, CVSS 9.8
NVFLARE unsafe deserialization due to Pickle
PyPI nvflare · Upgrade to 2.1.4 or later · < 2.1.4 · CVE-2022-34668 · GHSA-6qv6-q77g-7qm6 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.