Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 8.2
    CVE-2026-41273 Flowise: Unauthenticated OAuth 2.0 Access Token Disclosure via Public Chatflow
    npm
  2. 7.1
    CVE-2026-41271 Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains
    npm
  3. 7.1
    CVE-2026-41272 Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure)
    npm
  4. 7.1
    CVE-2026-41270 Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox
    npm
  5. 7.1
    CVE-2026-41269 Flowise: File Upload Validation Bypass in createAttachment
    npm
  6. 7.7
    CVE-2026-41268 Flowise: Flowise Parameter Override Bypass Remote Command Execution
    npm
    EPSS 17.4% chance of exploitation in 30 days, percentile 97%
  7. 7.5
    CVE-2026-41266 Flowise: Sensitive Data Leak in public-chatbotConfig
    npm
    EPSS 4.1% chance of exploitation in 30 days, percentile 90%
  8. 8.1
    CVE-2026-41267 Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association
    npm
  9. 8.8
    CVE-2026-41137 Flowise: Code Injection in CSVAgent leads to Authenticated RCE
    npm
    EPSS 1.5% chance of exploitation in 30 days, percentile 73%
  10. 8.3
    CVE-2026-41138 Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using Pandas.
    npm
  11. 9.8
    CVE-2026-41500 electerm has Command Injection Vulnerability via runMac function
    npm
    EPSS 1.6% chance of exploitation in 30 days, percentile 75%
  12. 7.1
    CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL
    npm
  13. 9.8
    CVE-2026-43995 Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)
    npm
  14. 6.5
    CVE-2026-56273 Flowise - Path Traversal in Vector Store basePath Parameter
    npm
  15. 4.6
    CVE-2026-56269 Flowise - Weak Default Token Hash Secret in JWT Token Encryption
    npm
  16. 9.1
    CVE-2026-56278 Flowise - Session Hijacking via Weak Default Express Session Secret
    npm
  17. 9.8
    CVE-2026-56271 Flowise - Weak Default JWT Secrets in Authentication Middleware
    npm
  18. 7.5
    CVE-2026-56270 Flowise - Unauthenticated OAuth Secrets Disclosure via /api/v1/loginmethod Endpoint
    npm
    EPSS 2.0% chance of exploitation in 30 days, percentile 81%
  19. 10.0
    CVE-2026-40933 Flowise: Authenticated RCE Via MCP Adapters
    npm
    EPSS 12.0% chance of exploitation in 30 days, percentile 96%
  20. 7.5
    CVE-2026-41180 PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart
    npm
  21. 4.7
    CVE-2026-41244 Mojic: Observable Timing Discrepancy in HMAC Verification
    npm
  22. 5.9
    CVE-2026-41213 @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes
    npm
  23. 8.7
    CVE-2026-39313 MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport
    npm
  24. 7.7
    CVE-2026-42438 OpenClaw 2026.4.9 < 2026.4.10 - Sender Policy Bypass in Host Media Attachment Reads
    npm
  25. 7.7
    CVE-2026-43580 OpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactions
    npm
  26. 9.8
    CVE-2026-43575 OpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route
    npm
  27. 7.7
    CVE-2026-43573 OpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes
    npm
  28. 8.6
    CVE-2026-43533 OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags
    npm
  29. 7.7
    CVE-2026-43576 OpenClaw < 2026.4.5 - Second-hop SSRF via CDP /json/version WebSocket URL
    npm
  30. 8.5
    CVE-2026-42439 OpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes
    npm