NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature

NPM: Ghost: Paid gift memberships obtainable at minimal cost via the donations feature vulnerability discovered by ? in WordPress Npm ghost versions = 6.27.0, 6.44.0...

NPM: Ghost: Member existence leak via magic link sign-in response

NPM: Ghost: Member existence leak via magic link sign-in response vulnerability discovered by ? in WordPress Npm ghost versions = 5.18.0, 6.21.1...

NPM: Ghost: Session Fixation in Ghost Admin

NPM: Ghost: Session Fixation in Ghost Admin vulnerability discovered by ? in WordPress Npm ghost versions = 2.2.0, 6.54.1...

NPM: Ghost: Theme Upload Path Traversal

NPM: Ghost: Theme Upload Path Traversal vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...

NPM: Ghost: Database Backup Path Traversal

NPM: Ghost: Database Backup Path Traversal vulnerability discovered by ? in WordPress Npm ghost versions = 1.20.1, 6.54.1...

NPM: Ghost: Server-Side Request Forgery in Image Fetching

NPM: Ghost: Server-Side Request Forgery in Image Fetching vulnerability discovered by ? in WordPress Npm ghost versions = 0.10.0, 6.54.1...

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions 6.54.1...

NPM: Ghost: Mobiledoc image-size fetch SSRF

NPM: Ghost: Mobiledoc image-size fetch SSRF vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...

NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling

NPM: Ghost: Server-side request forgery via DNS rebinding in external request handling vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, 6.21.1...

NPM: Ghost: Private IP filtering bypass to make server-side requests to internal services

NPM: Ghost: Private IP filtering bypass to make server-side requests to internal services vulnerability discovered by ? in WordPress Npm ghost versions = 6.0.9, = 6.21.0...

NPM: Ghost: Archived Offers can be Redeemed

NPM: Ghost: Archived Offers can be Redeemed vulnerability discovered by ? in WordPress Npm ghost versions = 4.22.0, 6.54.1...

NPM: Ghost: File Upload Content-Type Spoofing

NPM: Ghost: File Upload Content-Type Spoofing vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...

NPM: Ghost: Cross-Site Scripting in Universal Import

NPM: Ghost: Cross-Site Scripting in Universal Import vulnerability discovered by ? in WordPress Npm ghost versions = 5.26.0, 6.54.1...

NPM: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

NPM: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

NPM: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

NPM: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.3...

NPM: Flowise: Missing Authorization on Execution Update Endpoint

NPM: Flowise: Missing Authorization on Execution Update Endpoint vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Incomplete Credential Redaction Exposes Secrets via API

NPM: Flowise: Incomplete Credential Redaction Exposes Secrets via API vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

NPM: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

NPM: Flowise: Authenticated arbitrary file write in the S3 Directory document loader via unsanitized S3 object keys vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

NPM: Flowise: Authenticated arbitrary file write in the S3 Directory document loader via unsanitized S3 object keys vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

NPM: Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

NPM: Flowise: DELETE /api/v1/chatflows/:id does not validate resource type, allowing agentflows:delete and chatflows:delete to delete each other’s flow type vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise RCE via SQLite Record Manager Node

NPM: Flowise RCE via SQLite Record Manager Node vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise RCE via SQLite Record Manager Node

NPM: Flowise RCE via SQLite Record Manager Node vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

NPM: Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated overrideConfig Spread in Prediction API vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

NPM: Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent

NPM: Flowise: Remote Code Execution Vulnerability in CSVAgent discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise Sandbox Escape to RCE

NPM: Flowise Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise Sandbox Escape to RCE

NPM: Flowise Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

NPM: Flowise: Missing authorization on /api/v1/files allows low-privileged API keys to list and delete files across workspaces within the same organization vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise RCE via TypeORM DataSource

NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise RCE via TypeORM DataSource

NPM: Flowise RCE via TypeORM DataSource vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

NPM: Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

NPM: Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint

NPM: Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint discovered by ? in WordPress Npm flowise versions = 3.1.2...