CVE-2026-56271 Flowise - Weak Default JWT Secrets in Authentication Middleware

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses weak hardcoded default JWT secrets 'authtoken', 'refreshtoken' and default audience and issuer values 'AUDIENCE', 'ISSUER' in the enterprise passport authentication middleware packages/server/src/enterprise/middleware/passport/index.t...

CVE-2026-56271 Flowise - Weak Default JWT Secrets in Authentication Middleware

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses weak hardcoded default JWT secrets 'authtoken', 'refreshtoken' and default audience and issuer values 'AUDIENCE', 'ISSUER' in the enterprise passport authentication middleware packages/server/src/enterprise/middleware/passport/index.t...

CVE-2026-56271

Flowise prior to 3.1.0 (versions

EUVD-2026-43228

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses weak hardcoded default JWT secrets 'authtoken', 'refreshtoken' and default audience and issuer values 'AUDIENCE', 'ISSUER' in the enterprise passport authentication middleware packages/server/src/enterprise/middleware/passport/index.t...

CVE-2026-56271

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses weak hardcoded default JWT secrets 'authtoken', 'refreshtoken' and default audience and issuer values 'AUDIENCE', 'ISSUER' in the enterprise passport authentication middleware packages/server/src/enterprise/middleware/passport/index.t...

PT-2026-57552

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0 Description The enterprise passport authentication middleware in packages/server/src/enterprise/middleware/passport/index.ts uses weak hardcoded default secrets and values for audience and issuer. When the...

Malicious code in awesome-ts-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc9fa6bfe010d792303258bd713e854e8c218c18762d62b864e8a350d1b473e Package advertises itself as a TypeScript/ESLint/Jest toolkit but ships no such tooling. On import, index.js - run - packProjectBundle walks the...

CVE-2026-61447

PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent.executepython that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment...

CVE-2026-61447

PraxionAI before 1.6.78 exposes a remote code execution flaw in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandboxing. This enables prompt-injection to exfiltrate environment secrets and run arbitrary code on the host. The v...

EUVD-2026-43182

PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent.executepython that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment...

CVE-2026-61447 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent

PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent.executepython that executes LLM-generated Python code without AST validation, import restrictions, or sandbox enforcement. Attackers can influence LLM output through prompt injection to exfiltrate all environment...

EUVD-2026-43152

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the template body. This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal...

CVE-2026-10865 Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the template body. This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal...

MAL-2026-10185 Malicious code in authvaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6c707d53e30a333f8b8cf03ac2480eee3e2fa9c3c3164b1a100d333c91f9f3a On require of authvaultx main: auth.js, which loads lib/writer.js, top-level code attempts to load the separately published npm package...

PT-2026-57440

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.6.78 Description A remote code execution issue exists in the CodeAgent. execute python function. The software executes Python code generated by a Large Language Model LLM without employing Abstract Syntax Tree AST...

MAL-2026-10173 Malicious code in paysafe-vault (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf94daa791fb670bda071f1b90b36f5b1f89dfb2ffc7eb7ccbf798fdff8915c1 The package impersonates a Paysafe Customer Vault SDK but is a credential stealer. index.js defines an exfil routine that collects os.hostname,...

MAL-2026-10169 Malicious code in paysafe-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1dc1a7847e47ee850fe8a4011ce83950962ab65cc742eb52919d13abe431e59 [email protected] impersonates a Paysafe payments SDK package name, description "Paysafe JavaScript SDK", and repository URL...

UBUNTU-CVE-2026-59180

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based notification plugins and HTTP attachment and config loaders in apprise/attachment/http.py and apprise/config/http.py...

MAL-2026-10140 Malicious code in @amtrav/webservice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1536781ed617d290a8d9a96fa1a1230943a7cc05957b4b56f853caa902da5856 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10146 Malicious code in ng-search-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 095a335a93f1ebe0047f2cdf56c2d52551d7c8602ade2e850486a6e19f514545 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...