Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. —
    GHSA-7rx4-c5vx-g8w3 Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections
    npm
  2. 8.8
    CVE-2026-46490 samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
    npm
  3. 8.8
    CVE-2026-46480 Flowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover
    npm
  4. 8.8
    CVE-2026-46479 Flowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover
    npm
  5. 8.8
    CVE-2026-46478 Flowise: DatasetRow create+update mass-assignment allows cross-workspace row takeover
    npm
  6. 8.8
    CVE-2026-46477 Flowise: Dataset create+update mass-assignment allows cross-workspace dataset takeover
    npm
  7. 8.8
    CVE-2026-46476 Flowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeover
    npm
  8. 8.8
    CVE-2026-46475 Flowise: Assistant create+update mass-assignment allows cross-workspace assistant takeover
    npm
  9. 8.8
    CVE-2026-46444 Flowise: Vector Store No Permission Checks
    npm
  10. 8.1
    CVE-2026-45732 n8n: Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
    npm
  11. 9.0
    CVE-2026-44792 n8n: Source Control Pull SQL Injection
    npm
  12. 9.9
    CVE-2026-44791 n8n: XML Node Prototype Pollution Patch Bypass
    npm
  13. 8.8
    CVE-2026-44790 n8n: Arbitrary File Read via Git Node
    npm
  14. 9.9
    CVE-2026-44789 n8n: HTTP Request Node Pagination Prototype Pollution to RCE
    npm
  15. 6.5
    CVE-2026-46443 Flowise: Credential Data Leak
    npm
  16. 9.9
    CVE-2026-46442 Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape
    npm
    EPSS 33.0% chance of exploitation in 30 days, percentile 98%
  17. 9.6
    CVE-2026-46441 Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource Reassignment
    npm
  18. 9.9
    CVE-2026-56274 Flowise - Remote Code Execution via MCP Security Bypass in validateCommandFlags and validateArgsForLocalFileAccess
    npm
    1 public exploit EPSS 7.5% chance of exploitation in 30 days, percentile 94%
  19. 7.5
    CVE-2026-46440 Flowise: Basic Auth Credentials Exposed via API
    npm
  20. 8.1
    CVE-2026-42863 Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment
    npm
  21. 5.0
    CVE-2026-42862 Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment
    npm
  22. 9.6
    CVE-2026-42861 Flowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment
    npm
  23. 7.5
    CVE-2026-27886 Strapi may leak sensitive data via relational filtering due to lack of query sanitization
    npm
    EPSS 1.9% chance of exploitation in 30 days, percentile 80%
  24. 5.4
    CVE-2026-22707 Strapi Upload Plugin MIME Validation Bypass via Content API
    npm
  25. 6.1
    CVE-2026-46417 Angular: SSRF via Hostname Hijacking in @angular/platform-server
    npm
  26. 6.5
    CVE-2026-22706 Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
    npm
  27. 7.2
    CVE-2026-22599 Strapi Vulnerable to SQL Injection in Content Type Builder
    npm
    EPSS 1.2% chance of exploitation in 30 days, percentile 68%
  28. 5.3
    CVE-2025-64526 Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
    npm
  29. 7.6
    CVE-2026-45012 Apostrophe has authenticated SSRF in rich-text widget import via @apostrophecms/area/validate-widget
    npm
  30. 6.5
    CVE-2026-42853 @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input
    npm