168393 matches found
GHSA-JM22-3W23-5Q7W Ghost: Blind Password Hash Disclosure in Ghost Admin API
Impact Any staff-level user was able to leak the hashed passwords of other staff users. An offline password-guessing attack against the hashes could lead to account takeover if successful, but Device Verification should have prevented an attacker from logging in with a recovered password. Dependi...
Ghost: Cross-Site Scripting in Universal Import
Impact The Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. Vulnerable versions This vulnerability is present in Ghost from v5.26.0 up to v6.54.0. Patches v6.54.1 contains a fix for this issue. How to update For self-hosters...
NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
CVE-2026-69263 Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the mitigation for CVE-2025-8943 blocked -y and --yes flags on npx, but packages/components/nodes/tools/MCP/core.ts denied only PATH, LDLIBRARYPATH, DYLDLIBRARYPATH, and NODEOPTIONS by exact...
ROOT-APP-PYPI-CVE-2026-32597 CVE-2026-32597 in PyJWT - Patched by Root
Root has patched CVE-2026-32597 in the PyJWT package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48525 CVE-2026-48525 in PyJWT - Patched by Root
Root has patched CVE-2026-48525 in the PyJWT package for Root:PyPI. Multiple fixed versions available...
CVE-2026-69254
CVE-2026-69254 affects Flowise versions before 3.1.3. The issue arises in the executeJavaScriptCode() path where caller-provided nodeVMOptions are merged with default NodeVM security settings, allowing an attacker to override the sandbox protection. By reaching packages/server/src/routes/node-cus...
ROOT-APP-NPM-CVE-2021-43307 CVE-2021-43307 in semver-regex - Patched by Root
Root has patched CVE-2021-43307 in the semver-regex package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2024-45296 CVE-2024-45296 in path-to-regexp - Patched by Root
Root has patched CVE-2024-45296 in the path-to-regexp package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-3449 CVE-2026-3449 in @tootallnate/once - Patched by Root
Root has patched CVE-2026-3449 in the @tootallnate/once package for Root:npm. Multiple fixed versions available...
CLSA-2026-1785554486 TuxCare security update for guzzlehttp/psr7 (2 CVEs)
TuxCare rebuilt guzzlehttp/psr7 to address 2 CVEs. Fixed in 1.4.2-p2+tuxcare...
CLSA-2026-1785380788 TuxCare security update for protobufjs (11 CVEs)
TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 1.5.1-tuxcare.1...
CLSA-2026-1785291650 TuxCare security update for axios (2 CVEs)
TuxCare rebuilt axios to address 2 CVEs. Fixed in 0.24.0-tuxcare.4...
CLSA-2026-1785291369 TuxCare security update for org.springframework (1 CVE)
TuxCare rebuilt 25 org.springframework packages to address 1 CVE. Fixed in 6.2.15-tuxcare.2...
CLSA-2026-1785380784 TuxCare security update for org.apache.logging.log4j (1 CVE)
TuxCare rebuilt 32 org.apache.logging.log4j packages to address 1 CVE. Fixed in 2.22.1-tuxcare.3...
CLSA-2026-1784856398 TuxCare security update for axios (3 CVEs)
TuxCare rebuilt axios to address 3 CVEs. Fixed in 0.21.1-tuxcare.2...
CLSA-2026-1784856428 TuxCare security update for axios (3 CVEs)
TuxCare rebuilt axios to address 3 CVEs. Fixed in 1.7.5-tuxcare.3...
CLSA-2026-1784769620 TuxCare security update for svelte (2 CVEs)
TuxCare rebuilt svelte to address 2 CVEs. Fixed in 0.3.0-tuxcare.2...