Critical, CVSS 9.8
Apache Airflow Hive Provider vulnerable to Command Injection
PyPI apache-airflow-providers-apache-hive · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2022-46421 · GHSA-rc58-qr9j-cpgw · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 392 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 568 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
- High, CVSS 7.4
p4 vulnerable to Command Injection due to improper input sanitization
npm p4 · Upgrade to 0.0.7 or later · < 0.0.7 · CVE-2022-25171 · GHSA-jfm8-hwhg-r6gg · amended
- Critical, CVSS 9.8
FurqanSoftware/node-whois vulnerable to Prototype Pollution
npm whois · Upgrade to 2.13.6 or later · < 2.13.6 · CVE-2020-36618 · GHSA-97jv-c342-5xhc · amended
- High, CVSS 7.5
Knex.js has a limited SQL injection vulnerability
npm knex · Upgrade to 2.4.0 or later · < 2.4.0 · CVE-2016-20018 · GHSA-4jv9-3563-23j3 · amended
- High, CVSS 7.5
active_attr Improper Resource Shutdown or Release vulnerability
RubyGems active_attr · Upgrade to 0.15.4 or later · < 0.15.4 · CVE-2021-4250 · GHSA-4whf-rmx5-8frv
- Critical, CVSS 9.8
DNS NuGet package uses insufficiently random values
NuGet dns · Upgrade to 7.0.0 or later · < 7.0.0 · CVE-2021-4248 · GHSA-g3wc-xv93-445q
- High, CVSS 7.5
HuTool vulnerable to Uncontrolled Resource Consumption
Maven cn.hutool:hutool-core · Upgrade to 5.8.11 or later · < 5.8.11 · CVE-2022-4565 · GHSA-47vx-fqr5-j2gw
- Critical, CVSS 9.8
Alist vulnerable to Path Traversal
Go github.com/alist-org/alist/v3 · Upgrade to 3.6.0 or later · < 3.6.0 · CVE-2022-45969 · GHSA-pmg2-rph8-p8r6
- Critical, CVSS 9.8
npm package rfc6902 vulnerable to Prototype Pollution
npm rfc6902 · Upgrade to 5.0.0 or later · < 5.0.0 · CVE-2021-4245 · GHSA-p495-jxh2-wrfg · amended
- Critical, CVSS 9.8
replicator vulnerable to Deserialization of Untrusted Data
npm replicator · Upgrade to 1.0.4 or later · < 1.0.4 · CVE-2021-33420 · GHSA-hw46-vg6w-88fj · amended
- High, CVSS 8.8
.NET Remote Code Execution Vulnerability
NuGet microsoft.windowsdesktop.app.runtime.win-x86 · Upgrade to 7.0.1, 6.0.12 or 3.1.32 by release line · >= 3.1.0, <= 3.1.31; >= 6.0.0, <= 6.0.11; >= 7.0.0, <= 7.0.0 · +2 more packages · CVE-2022-41089 · GHSA-2c7v-qcjp-4mg2
- Critical, CVSS 9.1
Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter)
Packagist fixpunkt/fp-newsletter · Upgrade to 3.2.6, 2.1.2 or 1.1.1 by release line · >= 2.2.0, < 3.2.6; >= 2.0.0, < 2.1.2; < 1.1.1 · CVE-2022-47408 · GHSA-f683-35w9-28g5
- High, CVSS 7.5
"Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data
Packagist fixpunkt/fp-newsletter · Upgrade to 3.2.6, 2.1.2 or 1.1.1 by release line · < 1.1.1; >= 1.2.0, < 2.1.2; >= 3.0.0, < 3.2.6 · CVE-2022-47411 · GHSA-r44w-pfx8-28jv
- High, CVSS 7.5
"Newsletter subscriber management" (fp_newsletter) TYPO3 extension leaks subscriber data
Packagist fixpunkt/fp-newsletter · Upgrade to 3.2.6, 2.1.2 or 1.1.1 by release line · < 1.1.1; >= 1.2.0, < 2.1.2; >= 3.0.0, < 3.2.6 · CVE-2022-47410 · GHSA-vxmc-qg5x-pvfx
- Critical, CVSS 9.8
TYPO3 vulnerable to Insufficient Session Expiration
Packagist derhansen/fe_change_pwd +1 · Upgrade all 2 to 3.0.3 or 2.0.5 by release line · >= 3.0.0, < 3.0.3; < 2.0.5 · CVE-2022-47406 · GHSA-53mm-hx32-6475
- Critical, CVSS 9.8
SCIFIO vulnerable to Path Traversal
Maven io.scif:scifio · Upgrade to 0.43.3 or later · < 0.43.3 · CVE-2022-4493 · GHSA-cmwm-45mj-mpg3
- High, CVSS 8.8
Apache Atlas: zip path traversal in import functionality
Maven org.apache.atlas:apache-atlas · Upgrade to 2.3.0 or later · >= 0.8.4, < 2.3.0 · CVE-2022-34271 · GHSA-p782-4j23-xqcg
- Critical, CVSS 9.8
cycle-import-check vulnerable to Command Injection
npm cycle-import-check · Upgrade to 1.3.2 or later · < 1.3.2 · CVE-2022-24377 · GHSA-995x-33wq-8gc9 · amended
- Critical, CVSS 9.1
Keycloak vulnerable to path traversal via double URL encoding
Maven org.keycloak:keycloak-parent · Upgrade to 20.0.2 or later · <= 20.0.0 · CVE-2022-3782 · GHSA-g8q8-fggx-9r3q
- High, CVSS 8.8
pgadmin4 vulnerable to Code Injection
PyPI pgadmin4 · Upgrade to 6.17 or later · < 6.17 · CVE-2022-4223 · GHSA-3v6v-2x6p-32mc · amended
- High, CVSS 8.7
Denial of service by double-checked locking in openssl-src
crates.io openssl-src · Upgrade to 300.0.12 or later · >= 300.0.0, < 300.0.12 · CVE-2022-3996 · GHSA-vr8j-hgmm-jh9r
- Critical, CVSS 9.8
Apache CXF Server-Side Request Forgery vulnerability
Maven org.apache.cxf:cxf-core · Upgrade to 3.5.5 or 3.4.10 by release line · < 3.4.10; >= 3.5.0, < 3.5.5 · CVE-2022-46364 · GHSA-x3x3-qwjq-8gj4
- High, CVSS 7.8
PYSEC-2022-43062
PyPI pacparser · Upgrade to 1.4.0 or later · < 1.4.0 · CVE-2019-25078
- High, CVSS 7.5
Inefficient Regular Expression Complexity in rails-html-sanitizer
RubyGems rails-html-sanitizer · Upgrade to 1.4.4 or later · < 1.4.4 · CVE-2022-23517 · GHSA-5x79-w82f-gw8w
- High, CVSS 7.5
Uncontrolled Recursion in Loofah
RubyGems loofah · Upgrade to 2.19.1 or later · >= 2.2.0, < 2.19.1 · CVE-2022-23516 · GHSA-3x8r-x6xp-q4vm
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.