High, CVSS 8.8
Exposure of password hashes in notrinos/notrinos-erp
Packagist notrinos/notrinos-erp · Upgrade to 0.7 or later · < 0.7 · CVE-2022-2921 · GHSA-44w5-q257-8428
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- Critical, CVSS 9.8
Remote code execution in Apache Flume
Maven org.apache.flume.flume-ng-sources:flume-jms-source · Upgrade to 1.10.1 or later · >= 1.4.0, < 1.10.1 · CVE-2022-34916 · GHSA-h9mh-mgpv-gqmv
- High, CVSS 8.8
Incorrect Access Control and Cross Site Scripting in Jellyfin
NuGet jellyfin.common · Upgrade to 10.8.0 or later · < 10.8.0 · CVE-2022-35909 · GHSA-qwp3-5fw3-5wgv
- High, CVSS 8.8
Improper Privilege Management in com.xuxueli:xxl-job
Maven com.xuxueli:xxl-job · Upgrade to 2.4.0 or later · <= 2.3.1 · CVE-2022-36157 · GHSA-7qq9-9g2w-56f9
- High, CVSS 7.5
Path Traversal in Payara
Maven fish.payara.api:payara-bom · Upgrade to 5.2022.3 or later · < 5.2022.3 · CVE-2022-37422 · GHSA-h28c-453m-h9xm
- High, CVSS 8.7
Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service
npm vite · Upgrade to 3.0.0-beta.4 (pre-release) or 2.9.13 by release line · < 2.9.13; >= 3.0.0-alpha.0, < 3.0.0-beta.4 · CVE-2022-35204 · GHSA-mv48-hcvh-8jj8 · amended
- Critical, CVSS 9.8
Use of Hard-coded Credentials in AgileConfig.Client
NuGet agileconfig.client · Upgrade to 1.6.8 or later · < 1.6.8 · CVE-2022-35540 · GHSA-mj5w-w588-j6xg
- Critical, CVSS 9.8
OmniAuth's
lib/omniauth/failure_endpoint.rbdoes not escapemessage_keyvalueRubyGems omniauth · Upgrade to 2.0.0 or 1.9.2 by release line · < 1.9.2; >= 2.0.0.pre.rc1, <= 2.0.0.pre.rc1 · CVE-2020-36599 · GHSA-pm55-qfxr-h247
- High, CVSS 7.5
PocketMine-MP invalid skin geometry JSON data leading to server crash
Packagist pocketmine/pocketmine-mp · Upgrade to 4.7.2 or later · < 4.7.2 · GHSA-8cwq-4cmf-px73
- Critical, CVSS 10.0
React Editable Json Tree vulnerable to arbitrary code execution via function parsing
npm react-editable-json-tree · Upgrade to 2.2.2 or later · < 2.2.2 · CVE-2022-36010 · GHSA-j3rv-w43q-f9x2 · amended
- High, CVSS 8.2
Ethermint vulnerable to DoS through unintended Contract Selfdestruct
Go github.com/evmos/ethermint · Upgrade to 0.18.0 or later · <= 0.17.2 · +3 more packages · CVE-2022-35936 · GHSA-f92v-grc2-w2fg
- High, CVSS 7.9
OpenZeppelin Contracts vulnerable to ECDSA signature malleability
npm @openzeppelin/contracts +1 · Upgrade all 2 to 4.7.3 or later · >= 4.1.0, < 4.7.3 · CVE-2022-35961 · GHSA-4h98-2769-gh6h · amended
- High, CVSS 7.5
OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals
npm @openzeppelin/contracts +1 · Upgrade all 2 to 4.7.2 or later · >= 4.3.0, < 4.7.2 · CVE-2022-31198 · GHSA-xrc4-737v-9q75 · amended
- High, CVSS 8.7
Bots using py-cord as Discord API wrapper are vulnerable to shutdowns through remote code execution
PyPI py-cord · Upgrade to 2.0.1 or later · >= 2.0.0, <= 2.0.0 · CVE-2022-36024 · GHSA-qmhj-m29v-gvmr · amended
- High, CVSS 7.5
HashiCorp Consul Template could reveal Vault secret contents in error messages
Go github.com/hashicorp/consul-template · Upgrade to 0.29.2, 0.28.3 or 0.27.3 by release line · < 0.27.3; >= 0.28.0, < 0.28.3; >= 0.29.0, < 0.29.2 · CVE-2022-38149 · GHSA-8449-7gc2-pwrp
- High, CVSS 7.5
Mapbox is vulnerable to Integer Overflow
Maven com.mapbox.mapboxsdk:mapbox-android-core · Upgrade to 10.6.1 or later · < 10.6.1 · CVE-2022-38216 · GHSA-4696-g7jj-xg2h
- High, CVSS 8.8
Remote code execution in Apache Airflow Docker's Provider
PyPI apache-airflow-providers-docker · Upgrade to 3.0.0 or later · < 3.0.0 · CVE-2022-38362 · GHSA-746v-hfh2-xphm · amended
- High, CVSS 8.8
Magento Improper Access Control vulnerability
Packagist magento/community-edition · Upgrade to 2.4.5, 2.4.3-p3 (pre-release) or 2.3.7-p4 (pre-release) by release line · >= 2.3.0, < 2.3.7-p4; >= 2.4.4, < 2.4.5; >= 2.4.0, < 2.4.3-p3 · CVE-2022-34255 · GHSA-x95x-f4g9-mm85
- High, CVSS 8.5
Magento Path Traversal vulnerability
Packagist magento/community-edition · Upgrade to 2.4.5, 2.4.3-p3 (pre-release) or 2.3.7-p4 (pre-release) by release line · >= 2.3.0, < 2.3.7-p4; >= 2.4.0, < 2.4.3-p3; >= 2.4.4, <= 2.4.4 · CVE-2022-34254 · GHSA-fx9g-g9q6-x3jx
- High, CVSS 7.5
Magento Improper Authorization vulnerability
Packagist magento/community-edition · Upgrade to 2.4.5, 2.4.3-p3 (pre-release) or 2.3.7-p4 (pre-release) by release line · >= 2.3.0, < 2.3.7-p4; >= 2.4.4, < 2.4.5; >= 2.4.0, < 2.4.3-p3 · CVE-2022-34256 · GHSA-r7mm-grf3-5fjv
- Critical, CVSS 9.1
Magento XML Injection vulnerability in the Widgets Module
Packagist magento/community-edition · Upgrade to 2.4.5, 2.4.3-p3 (pre-release) or 2.3.7-p4 (pre-release) by release line · < 2.3.7-p4; >= 2.4.4, < 2.4.5; >= 2.4.0, < 2.4.3-p3 · CVE-2022-34253 · GHSA-cj7w-pm77-hvg6
- High, CVSS 8.8
Moodle Incorrect Authorization vulnerability
Packagist moodle/moodle · Upgrade to 3.9.1, 3.8.4, 3.7.7 or 3.5.13 by release line · >= 3.9.0-beta, < 3.9.1; >= 3.8.0-beta, < 3.8.4; >= 3.6.0-beta, < 3.7.7; < 3.5.13 · CVE-2020-14321 · GHSA-9q29-jcjw-fw7h
- High, CVSS 8.8
Cockpit Content Platform vulnerable to 2FA bypass
Packagist cockpit-hq/cockpit · Upgrade to 2.2.2 or later · <= 2.2.1 · CVE-2022-2818 · GHSA-8wj3-cpmr-8whp
- High, CVSS 7.5
OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information
Maven org.opensearch.plugin:opensearch-security · Upgrade to 2.2.0.0 or later · >= 2.0.0.0, <= 2.1.0.0 · CVE-2022-35980 · GHSA-f4qr-f4xx-hjxw
- Critical, CVSS 9.3
loopback-connector-postgresql Vulnerable to Improper Sanitization of
containsFilternpm loopback-connector-postgresql · Upgrade to 5.5.1 or later · < 5.5.1 · CVE-2022-35942 · GHSA-j259-6c58-9m58 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.