The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total50,284
Mitigations16,213
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
ghost>= 6.0.9, <= 6.21.0
NPM: Ghost: Private IP filtering bypass to make server-side requests to internal services
5.8
15 minutes ago
ghost>= 4.22.0, < 6.54.1
NPM: Ghost: Archived Offers can be Redeemed
4.8
17 minutes ago
ghost>= 6.19.4, < 6.21.1
NPM: Ghost: File Upload Content-Type Spoofing
5.4
23 minutes ago
ghost>= 5.26.0, < 6.54.1
NPM: Ghost: Cross-Site Scripting in Universal Import
5
25 minutes ago
flowise<= 3.1.2
NPM: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
9.2
1 hour ago
flowise<= 3.1.2
NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
9.5
1 hour ago
flowise-components<= 3.1.2
NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
9.5
1 hour ago
flowise<= 3.1.2
NPM: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
8.3
2 hours ago
flowise<= 3.1.3
NPM: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials
6.3
2 hours ago
flowise<= 3.1.2
NPM: Flowise: Missing Authorization on Execution Update Endpoint
7.1
2 hours ago
flowise<= 3.1.2
NPM: Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
7.6
3 hours ago
flowise<= 3.1.2
NPM: Flowise: Incomplete Credential Redaction Exposes Secrets via API
6.5
3 hours ago
flowise<= 3.1.2
NPM: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
8.3
3 hours ago
flowise<= 3.1.2
NPM: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
7.1
3 hours ago
flowise<= 3.1.2
NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
9.4
3 hours ago
flowise-components<= 3.1.2
NPM: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
9.4
3 hours ago
flowise<= 3.1.2
NPM: Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
7.2
3 hours ago
flowise-components<= 3.1.2
NPM: Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
7.2
3 hours ago
flowise<= 3.1.2
NPM: Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
7.1
3 hours ago
flowise<= 3.1.2
NPM: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE
9.5
3 hours ago