High, CVSS 8.2
Cronos vulnerable to DoS through unintended Contract Selfdestruct
Go github.com/crypto-org-chain/cronos · Upgrade to 0.8.0 or later · <= 0.7.0 · GHSA-gwj5-wp6r-5q9f
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Django vulnerable to Reflected File Download attack
PyPI django · Upgrade to 4.0.7 or 3.2.15 by release line · >= 4.0, < 4.0.7; < 3.2.15 · CVE-2022-36359 · GHSA-8x94-hmjh-97hq · amended
- High, CVSS 7.1
cosign's
cosign verify-attestaton --typecan report a false positive if any attestation existsGo github.com/sigstore/cosign · Upgrade to 1.10.1 or later · < 1.10.1 · CVE-2022-35929 · GHSA-vjxv-45g9-9296
- High, CVSS 7.1
PolicyController before 0.2.1 may bypass attestation verification
Go github.com/sigstore/policy-controller · Upgrade to 0.2.1 or later · < 0.2.1 · CVE-2022-35930 · GHSA-739f-hw6h-7wq8
- Critical, CVSS 9.8
ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution
npm ts-deepmerge · Upgrade to 2.0.2 or later · < 2.0.2 · CVE-2022-25907 · GHSA-7qqq-gh2f-wq76 · amended
- High, CVSS 7.5
Apache Avro Rust SDK vulnerable to reader looping in cycle endlessly, consuming CPU
crates.io apache-avro · Upgrade to 0.14.0 or later · < 0.14.0 · CVE-2022-35724 · GHSA-v456-chpw-6mmw
- High, CVSS 7.5
Apache Avro Rust SDK corrupted data read can cause crash
crates.io apache-avro · Upgrade to 0.14.0 or later · < 0.14.0 · CVE-2022-36125 · GHSA-3w5g-989p-35r8
- High, CVSS 7.5
Apache Avro Rust SDK's Reader could consume memory beyond allowed constraints
crates.io apache-avro · Upgrade to 0.14.0 or later · < 0.14.0 · CVE-2022-36124 · GHSA-wcm8-86x6-8mv3
- Critical, CVSS 9.8
Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration
Packagist aheinze/cockpit · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2022-2713 · GHSA-vm6p-35rw-3fxc
- High, CVSS 7.2
Drupal core arbitrary PHP code execution
Packagist drupal/core · Upgrade to 9.4.3 or 9.3.19 by release line · >= 8.0.0, < 9.3.19; >= 9.4.0, < 9.4.3 · CVE-2022-25277 · GHSA-6955-67hm-vjjq
- High, CVSS 7.1
PostgreSQL JDBC Driver SQL Injection in ResultSet.refreshRow() with malicious column names
Maven org.postgresql:postgresql · Upgrade to 42.4.1, 42.3.7 or 42.2.26 by release line · < 42.2.26; >= 42.4.0, < 42.4.1; >= 42.3.0, < 42.3.7 · CVE-2022-31197 · GHSA-r38f-c4h4-hqq2
- High, CVSS 7.2
DSpace ItemImportService API Vulnerable to Path Traversal in Simple Archive Format Package Import
Maven org.dspace:dspace-api · Upgrade to 6.4 or 5.11 by release line · >= 4.0, < 5.11; >= 6.0, < 6.4 · CVE-2022-31195 · GHSA-8rmh-55h4-93h5
- High, CVSS 8.2
JSPUI vulnerable to path traversal in submission (resumable) upload
Maven org.dspace:dspace-jspui · Upgrade to 6.4 or 5.11 by release line · >= 4.0, < 5.11; >= 6.0, < 6.4 · CVE-2022-31194 · GHSA-qp5m-c3m9-8q2p
- High, CVSS 7.1
JSPUI's controlled vocabulary feature vulnerable to Open Redirect before v6.4 and v5.11
Maven org.dspace:dspace-jspui · Upgrade to 6.4 or 5.11 by release line · >= 4.0, < 5.11; >= 6.0, < 6.4 · CVE-2022-31193 · GHSA-763j-q7wv-vf3m
- High, CVSS 7.1
JSPUI Possible Cross Site Scripting in "Request a Copy" Feature
Maven org.dspace:dspace-jspui · Upgrade to 6.4 or 5.11 by release line · >= 5.0, < 5.11; >= 6.0, < 6.4 · CVE-2022-31192 · GHSA-4wm8-c2vv-xrpq
- High, CVSS 7.1
JSPUI spellcheck and autocomplete tools vulnerable to Cross Site Scripting
Maven org.dspace:dspace-jspui · Upgrade to 6.4 or 5.11 by release line · >= 4.0, < 5.11; >= 6.0, < 6.4 · CVE-2022-31191 · GHSA-c558-5gfm-p2r8
- High, CVSS 7.5
Drupal core Information Disclosure vulnerability
Packagist drupal/core · Upgrade to 9.4.3, 9.3.19 or 7.91 by release line · >= 7.0.0, < 7.91; >= 8.0.0, < 9.3.19; >= 9.4.0, < 9.4.3 · CVE-2022-25275 · GHSA-xh3v-6f9j-wxw3
- High, CVSS 8.7
untangle vulnerable to XML Entity Expansion
PyPI untangle · Upgrade to 1.2.1 or later · < 1.2.1 · CVE-2022-33977 · GHSA-7xr3-6ggc-wc9p · amended
- High, CVSS 8.7
untangle vulnerable to Improper Restriction of XML External Entity Reference
PyPI untangle · Upgrade to 1.2.1 or later · < 1.2.1 · CVE-2022-31471 · GHSA-f83q-2cp7-qrjg · amended
- High, CVSS 8.3
sanic vulnerable to Path Traversal when using
app.staticif using encoded%2FURLsPyPI sanic · Upgrade to 22.6.1, 21.12.2 or 20.12.7 by release line · >= 22.0.0, < 22.6.1; >= 21.0.0, < 21.12.2; < 20.12.7 · CVE-2022-35920 · GHSA-8cw9-5hmv-77w6 · amended
- High, CVSS 7.5
Rust-WebSocket memory allocation based on untrusted length
crates.io websocket · Upgrade to 0.26.5 or later · < 0.26.5 · CVE-2022-35922 · GHSA-qrjv-rf5q-qpxc
- Critical, CVSS 9.8
@acrontum/filesystem-template vulnerable to Command Injection due to fetchRepo API missing sanitization
npm @acrontum/filesystem-template · Upgrade to 0.0.2 or later · < 0.0.2 · CVE-2022-21186 · GHSA-m2fc-9h5m-29cm · amended
- High, CVSS 7.5
Undertow vulnerable to Dos via Large AJP request
Maven io.undertow:undertow-core · Upgrade to 2.3.0.Alpha2 or 2.2.19.Final by release line · < 2.2.19.Final; >= 2.3.0.Alpha1, <= 2.3.0.Alpha1 · CVE-2022-2053 · GHSA-95rf-557x-44g5
- High, CVSS 8.8
Apache JSPWiki CSRF due to crafted invocation on the Image plugin
Maven org.apache.jspwiki:jspwiki-main · Upgrade to 2.11.3 or later · < 2.11.3 · CVE-2022-34158 · GHSA-jp3m-p26h-mm7v
- Critical, CVSS 9.8
Apache Hadoop argument injection vulnerability
Maven org.apache.hadoop:hadoop-common · Upgrade to 3.3.3, 3.2.4 or 2.10.2 by release line · >= 2.0.0, < 2.10.2; >= 3.0.0-alpha, < 3.2.4; >= 3.3.0, < 3.3.3 · CVE-2022-25168 · GHSA-8wm5-8h9c-47pc
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.