High, CVSS 7.1
URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths
PyPI matrix-synapse · Upgrade to 1.61.1 or later · < 1.61.1 · CVE-2022-31052 · GHSA-22p3-qrh9-cx32 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.3
Authorization Bypass in parse-path
npm parse-path · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2022-0624 · GHSA-3j8f-xvm3-ffx4 · amended
- Critical, CVSS 9.8
Server-Side Request Forgery in parse-url
npm parse-url · Upgrade to 6.0.1 or later · < 6.0.1 · CVE-2022-2216 · GHSA-7f3x-x4pr-wqhj · amended
- High, CVSS 7.5
Hostname confusion in parse-url
npm parse-url · Upgrade to 6.0.1 or later · < 6.0.1 · CVE-2022-0722 · GHSA-4p35-cfcx-8653 · amended
- High, CVSS 8.7
SystemDS CPU exhaustion vulnerability
PyPI systemds +1 · Upgrade all 2 to 2.2.2 or later · < 2.2.2 · CVE-2022-26477 · GHSA-m43h-hfrq-x8wx · amended
- High, CVSS 7.7
Salt's PAM auth fails to reject locked accounts
PyPI salt · Upgrade to 3004.2, 3003.5 or 3002.9 by release line · < 3002.9; >= 3003.0, < 3003.5; >= 3004.0, < 3004.2 · CVE-2022-22967 · GHSA-fpxm-fprw-6hxj · amended
- High, CVSS 8.6
JWS and JWT signature validation vulnerability with special characters
npm jsrsasign · Upgrade to 10.5.25 or later · >= 4.8.0, < 10.5.25 · CVE-2022-25898 · GHSA-3fvg-4v2m-98jf · amended
- High, CVSS 8.1
BlockWishList SQL Injection vulnerability
Packagist prestashop/blockwishlist · Upgrade to 2.1.1 or later · >= 2.0.0, < 2.1.1 · CVE-2022-31101 · GHSA-2jx3-5j9v-prpp
- Critical, CVSS 9.1
Path traversal in Concrete CMS
Packagist concrete5/core · Upgrade to 9.1.0 or 8.5.8 by release line · >= 9.0.0, < 9.1.0; < 8.5.8 · CVE-2022-30117 · GHSA-3jxh-6635-6jwp
- High, CVSS 8.0
Code injection in concrete CMS
Packagist concrete5/core · Upgrade to 9.1.0 or 8.5.8 by release line · >= 9.0.0, < 9.1.0; < 8.5.8 · CVE-2022-21829 · GHSA-6xc4-7fmm-65q2
- High, CVSS 7.5
Query predicate bypass in Zalando Skipper
Go github.com/zalando/skipper · Upgrade to 0.13.218 or later · < 0.13.218 · CVE-2022-34296 · GHSA-qx2j-85q5-ffp8
- High, CVSS 8.0
Cross-site Scripting vulnerability in Jenkins
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.356 or later · >= 2.340, < 2.356 · CVE-2022-34173 · GHSA-6g4r-q7qg-6qx6
- Critical, CVSS 9.8
Improper handling of double quotes in file name in Diffy in Windows environment
RubyGems diffy · Upgrade to 3.4.1 or later · < 3.4.1 · CVE-2022-33127 · GHSA-5ww9-9qp2-x524
- High, CVSS 8.0
Cross-site Scripting vulnerability in Jenkins
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.356, 2.346.1 or 2.332.4 by release line · >= 2.350, < 2.356; >= 2.346, < 2.346.1; < 2.332.4 · CVE-2022-34171 · GHSA-7f84-p6r5-jr6q
- High, CVSS 8.0
Cross-site Scripting in Jenkins Sauce OnDemand Plugin
Maven org.jenkins-ci.plugins:sauce-ondemand · Upgrade to 1.205 or later · <= 1.204 · CVE-2022-34197 · GHSA-cqhr-q835-62gm
- High, CVSS 8.8
Reflected Cross-site Scripting in Jenkins Nested View Plugin
Maven org.jenkins-ci.plugins:nested-view · Upgrade to 1.26 or later · >= 1.20, < 1.26 · CVE-2022-34182 · GHSA-h642-5h74-3x9c
- High, CVSS 7.5
Unauthorized view fragment access in Jenkins
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.356 or later · >= 2.335, < 2.356 · CVE-2022-34175 · GHSA-p3rc-946h-8cf5
- High, CVSS 8.0
Cross-site Scripting vulnerability in Jenkins
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.356 or 2.332.4 by release line · >= 2.340, < 2.356; >= 2.332, < 2.332.4 · CVE-2022-34172 · GHSA-mhp7-3393-pfqr
- High, CVSS 8.0
Cross-site Scripting in Jenkins Hidden Parameter Plugin
Maven org.jenkins-ci.plugins:hidden-parameter · Upgrade to 0.0.5 or later · < 0.0.5 · CVE-2022-34188 · GHSA-jhfv-8936-g652
- High, CVSS 8.8
Reflected Cross site scripting in Jenkins Embeddable Build Status Plugin
Maven org.jenkins-ci.plugins:embeddable-build-status · Upgrade to 2.0.4 or later · < 2.0.4 · CVE-2022-34178 · GHSA-39r3-h8q6-2phq
- High, CVSS 8.0
Cross-site Scripting in Jenkins REST List Parameter Plugin
Maven io.jenkins.plugins:rest-list-parameter · Upgrade to 1.6.0 or later · < 1.6.0 · CVE-2022-34196 · GHSA-pc9c-547w-hhmc
- High, CVSS 8.0
Cross-site Scripting in Jenkins NS-ND Integration Performance Publisher Plugin
Maven io.jenkins.plugins:cavisson-ns-nd-integration · Upgrade to 4.8.0.129 or later · < 4.8.0.129 · CVE-2022-34191 · GHSA-pv38-mqpp-v72h
- High, CVSS 8.0
Cross-site Scripting vulnerability in Jenkins
Maven org.jenkins-ci.main:jenkins-core · Upgrade to 2.356, 2.346.1 or 2.332.4 by release line · >= 2.350, < 2.356; >= 2.320, < 2.332.4; >= 2.346, < 2.346.1 · CVE-2022-34170 · GHSA-62wf-24c4-8r76
- High, CVSS 8.0
Cross-site Scripting in Jenkins JUnit Plugin
Maven org.jenkins-ci.plugins:junit · Upgrade to 1119.1121.vc43d0fc45561 or later · < 1119.1121.vc43d0fc45561 · CVE-2022-34176 · GHSA-64mj-3p92-589v
- High, CVSS 8.8
Arbitrary file write vulnerability in Jenkins Pipeline: Input Step Plugin
Maven org.jenkins-ci.plugins:pipeline-input-step · Upgrade to 449.v77f0e8b (pre-release) or later · < 449.v77f0e8b · CVE-2022-34177 · GHSA-29q6-p2cg-4v23
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.