CVE-2026-66901 Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...

CVE-2026-66901

CVE-2026-66901 : Google::Auth for Perl before version 0.09 is prone to server-side request forgery and credential exfiltration due to unvalidated URLs sourced from the credentials JSON. The attack could reach hosts in the configuration’s network position (including internal services and metadata ...

CVE-2026-70478

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Summary The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is in WHITELISTURLS, meaning it requires no authentication. It decrypts the stored credential containing clientId, clientSecret, refreshtoken, sends a refresh request to the configured OAuth provider, a...

CVE-2026-70478

Summary of CVE-2026-70478 (Flowise) : The unauthenticated endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is exposed via WHITELIST_URLS and decrypts the stored credential to perform an OAuth token refresh, returning a new access_token in the response. An attacker with a valid creden...

CVE-2026-70478 Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...

CVE-2026-70472

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-store endpoints accept a client-controlled credential parameter and load credentials by id without checking whether that credential belongs to the caller...

Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Summary Three OAuth2 credential endpoints look up credentials by id alone with no workspaceId filter. Two of these endpoints callback, refresh are whitelisted from all authentication. This allows: 1. Cross-workspace credential access — Any authenticated user can initiate OAuth2 flows against...

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

CVE-2026-70474 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise has three OAuth2 credential endpoints that look up credentials by id alone with no workspaceId filter. The authorize, callback, and refresh handlers query the Credential table...

CVE-2026-70474

Flowise (flows builder UI) has a cross-workspace OAuth2 credential metadata leak prior to version 3.1.3. Three OAuth2 credential endpoints—/api/v1/oauth2-credential/authorize/, /api/v1/oauth2-credential/callback?code=ATTACKER_AUTH_CODE&state=, and /api/v1/oauth2-credential/refresh/—query the Cred...

Malicious code in @umacloud/cli-darwin-x64 (npm)

npm/@umacloud/cli-darwin-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11791 Malicious code in @qlik/embed-svelte (npm)

npm/@qlik/embed-svelte is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11954 Malicious code in @umacloud/cli-darwin-x64 (npm)

npm/@umacloud/cli-darwin-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11956 Malicious code in @umacloud/cli-linux-musl-arm64 (npm)

npm/@umacloud/cli-linux-musl-arm64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11955 Malicious code in @umacloud/cli-linux-arm64 (npm)

npm/@umacloud/cli-linux-arm64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @qlik/dts-bundler (npm)

npm/@qlik/dts-bundler is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

Malicious code in @umacloud/cli-linux-x64 (npm)

npm/@umacloud/cli-linux-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in umadev (npm)

npm/umadev is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the worm...

Malicious code in @adminide-stack/clock-tik-browser (npm)

npm/@adminide-stack/clock-tik-browser is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...