Critical, CVSS 9.0
Joplin is vulnerable to arbitrary code execution
npm joplin · Upgrade to 2.9.1 or later · < 2.9.1 · CVE-2022-35131 · GHSA-ww2v-frv5-pj5x · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 8.8
Mistune vulnerable to catastrophic backtracking
PyPI mistune · Upgrade to 2.0.3 or later · >= 2.0.0a1, < 2.0.3 · CVE-2022-34749 · GHSA-fw3v-x4f2-v673 · amended
- High, CVSS 7.5
Apache MXNet vulnerable to potential denial-of-service by excessive resource consumption
PyPI mxnet · Upgrade to 1.9.1 or later · < 1.9.1 · CVE-2022-24294 · GHSA-xxj3-55p6-xg3h · amended
- Critical, CVSS 9.8
convert-svg-core vulnerable to remote code injection
npm convert-svg-core · Upgrade to 0.6.2 or later · < 0.6.2 · CVE-2022-25759 · GHSA-5gxc-fxcr-9326 · amended
- Critical, CVSS 9.8
Dataease v1.11.1 SQL Injection via parameter dataSourceId
Maven io.dataease:dataease-plugin-common · Upgrade to 1.11.2 or later · < 1.11.2 · CVE-2022-34115 · GHSA-vjmr-6pmm-rprf
- High, CVSS 8.8
SQL Injection found in Dataease
Maven io.dataease:dataease-plugin-common · Upgrade to 1.11.2 or later · < 1.11.2 · CVE-2022-34114 · GHSA-hmvw-66jm-h9fh
- Critical, CVSS 9.8
Dataease before 1.11.2 allows arbitrary code execution via crafter plugin
Maven io.dataease:dataease-plugin-common · Upgrade to 1.11.2 or later · <= 1.11.1 · CVE-2022-34113 · GHSA-5469-c5p2-xv5g
- Critical, CVSS 9.8
PYSEC-2022-43166
PyPI scu-captcha · Upgrade to 0.0.5 or later · >= 0.0.1, < 0.0.5 · CVE-2022-34983
- High, CVSS 7.5
file-type vulnerable to Infinite Loop via malformed MKV file
npm file-type · Upgrade to 17.1.3 or 16.5.4 by release line · >= 17.0.0, < 17.1.3; >= 13.0.0, < 16.5.4 · CVE-2022-36313 · GHSA-mhxj-85r3-2x55 · amended
- Critical, CVSS 10.0
Islandora 2.0 before 2.4.1 could allow any user to upload content into a repository
Packagist islandora/islandora · Upgrade to 2.4.1 or later · >= 2.0, < 2.4.1 · GHSA-m58q-qq5h-mgqq
- High, CVSS 7.5
OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers
npm @openzeppelin/contracts +1 · Upgrade all 2 to 4.7.1 or later · >= 4.1.0, < 4.7.1 · CVE-2022-31172 · GHSA-4g63-c64m-25w9 · amended
- High, CVSS 7.5
OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
npm @openzeppelin/contracts +1 · Upgrade all 2 to 4.7.1 or later · >= 4.0.0, < 4.7.1 · CVE-2022-31170 · GHSA-qh9x-gcfh-pcrw · amended
- High, CVSS 7.5
TZInfo relative path traversal vulnerability allows loading of arbitrary files
RubyGems tzinfo · Upgrade to 1.2.10 or 0.3.61 by release line · < 0.3.61; >= 1.0.0, < 1.2.10 · CVE-2022-31163 · GHSA-5cm2-9h8c-rvfx
- Critical, CVSS 9.8
Grails framework Remote Code Execution via Data Binding
Maven org.grails:grails-databinding · Upgrade to 5.2.1, 5.1.9, 4.1.1 or 3.3.15 by release line · >= 3.3.10, < 3.3.15; >= 4.0.0, < 4.1.1; >= 5.0.0, < 5.1.9; >= 5.2.0, <= 5.2.0 · CVE-2022-35912 · GHSA-6rh6-x8ww-9h97
- Critical, CVSS 10.0
Java Melody vulnerable to cross-site scripting
Maven net.bull.javamelody:javamelody-core · Upgrade to 1.61.0 or later · < 1.61.0 · CVE-2016-1000273 · GHSA-cqhr-jqvc-qw9p
- High, CVSS 7.5
Slack Morphism for Rust before 0.41.0 can leak Slack OAuth client information in application debug logs
crates.io slack-morphism · Upgrade to 0.41.0 or later · < 0.41.0 · CVE-2022-31162 · GHSA-99j7-mhfh-w84p
- High, CVSS 7.5
Apache Xalan Java XSLT library integer truncation issue when processing malicious XSLT stylesheets
Maven xalan:xalan · Upgrade to 2.7.3 or later · < 2.7.3 · CVE-2022-34169 · GHSA-9339-86wc-4qgf
- Critical, CVSS 9.8
Properties-Reader before v2.2.0 vulnerable to prototype pollution
npm properties-reader · Upgrade to 2.2.0 or later · < 2.2.0 · CVE-2020-28471 · GHSA-jxvf-m3x5-mxwq · amended
- High, CVSS 8.7Exploited · CISA KEV
Apache Spark UI can allow impersonation if ACLs enabled
Maven org.apache.spark:spark-parent_2.12 · Upgrade to 3.2.2; some affected versions have no fix yet · <= 3.0.3; >= 3.1.1, < 3.2.2 · +1 more package · CVE-2022-33891 · GHSA-4x9r-j582-cgr8 · amended
- High, CVSS 7.5
Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header
npm skywalking-backend-js · Upgrade to 0.5.1 or later · < 0.5.1 · CVE-2022-36127 · GHSA-8gpg-466c-5cpj · amended
- Critical, CVSS 9.8
thenify before 3.3.1 made use of unsafe calls to
eval.npm thenify +1 · Upgrade all 2 to 3.3.1 or later · < 3.3.1 · CVE-2020-7677 · GHSA-29xr-v42j-r956 · amended
- High, CVSS 7.5
glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service
npm glob-parent · Upgrade to 6.0.1 or later · >= 6.0.0, <= 6.0.0 · CVE-2021-35065 · GHSA-cj88-88mr-972w · amended
- High, CVSS 7.5
Apache Hive before 3.1.3
CREATEandDROPfunction operations do not check for necessary authorization.Maven org.apache.hive:hive · Upgrade to 3.1.3 or later · < 3.1.3 · CVE-2021-34538 · GHSA-v3p8-j597-3xg8
- Critical, CVSS 9.3
Octobot mishandles Tentacles upload
PyPI octobot · Upgrade to 0.4.4 or later · < 0.4.4 · CVE-2021-36711 · GHSA-fr75-x856-q6j8 · amended
- High, CVSS 7.5
Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages
Go github.com/containrrr/shoutrrr · Upgrade to 0.6.0 or later · < 0.6.0 · CVE-2022-25891 · GHSA-477v-w82m-634j
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.