Ghost: Mobiledoc image-size fetch SSRF

CVE-2026-53946

### Impact When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to

历史摘要 · 未重新核验 · GitHub Advisory

Ghost: Server-side request forgery via DNS rebinding in external request handling

CVE-2026-53945

### Impact Ghost’s private-IP check for outbound HTTP requests could be bypassed via DNS rebinding, allowing an attacke

历史摘要 · 未重新核验 · GitHub Advisory

Ghost: Private IP filtering bypass to make server-side requests to internal services

CVE-2026-53944

### Impact When making an external request, it is possible to bypass the IP filter that ensures the request isn't going

历史摘要 · 未重新核验 · GitHub Advisory

Ghost: Archived Offers can be Redeemed

CVE-2026-70589

### Impact A missing validation check allowed users to redeem subscription offers that were no longer active. ### Vuln

历史摘要 · 未重新核验 · GitHub Advisory

Ghost: File Upload Content-Type Spoofing

CVE-2026-53948

### Impact Insufficient validation of the client-supplied `Content-Type` on Ghost's Admin API file upload endpoint allo

历史摘要 · 未重新核验 · GitHub Advisory

Ghost: Cross-Site Scripting in Universal Import

CVE-2026-70588

### Impact The Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in

历史摘要 · 未重新核验 · GitHub Advisory

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

CVE-2026-70478

### Summary The OAuth2 token refresh endpoint (`POST /api/v1/oauth2-credential/refresh/:credentialId`) is in `WHITELIST

历史摘要 · 未重新核验 · GitHub Advisory

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

CVE-2026-70477

-- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affe

历史摘要 · 未重新核验 · GitHub Advisory

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

CVE-2026-70476

### Summary Several organization billing endpoints accept attacker-controlled Stripe identifiers (subscriptionId) withou

历史摘要 · 未重新核验 · GitHub Advisory

Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS Credentials

## Summary The `/api/v1/text-to-speech/generate` endpoint is whitelisted (requires no authentication) and accepts any `

历史摘要 · 未重新核验 · GitHub Advisory

Flowise: Missing Authorization on Execution Update Endpoint

CVE-2026-70475

# Flowise Security Audit Report **Date**: 2026-03-17 **Researcher**: Dimpal Jadhav (jadhavdimpy@gmail.com) **GitHub**: h

历史摘要 · 未重新核验 · GitHub Advisory

Sequelize: SQL Injection (Oracle DB)

CVE-2026-69240

### Summary SQL Injection is possible with strings only **if dialect is set to `oracle`**. The vulnerability was confirm

历史摘要 · 未重新核验 · GitHub Advisory

Hono: ReDoS in CORS middleware via Access-Control-Request-Headers

CVE-2026-69207

### Summary The built-in CORS middleware (`hono/cors`) parses the attacker-controlled `Access-Control-Request-Headers`

历史摘要 · 未重新核验 · GitHub Advisory

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

CVE-2026-69192

### Summary `Address4` accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL hos

历史摘要 · 未重新核验 · GitHub Advisory

ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

CVE-2026-69198

### Summary Every special-use classification method is built on `isInSubnet`, which short-circuits to `false` whenever

历史摘要 · 未重新核验 · GitHub Advisory

ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks

CVE-2026-54272

### Summary `Address6`'s special-property checks misclassify IPv4-mapped (`::ffff:0:0/96`) and NAT64 well-known (`64:ff

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to CRLF Injection via blob-like body 'type' property

CVE-2026-15157

### Impact When an application passes a duck-typed blob-like body to undici's HTTP/1.1 dispatcher (via `request()`, `st

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

CVE-2026-14643

## Impact Undici's cache interceptor mishandles optional whitespace (OWS) placed around the `=` of a qualified `no-cach

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

CVE-2026-16729

## Impact The `setCookie` function has two attribute injection paths. `validateCookieDomain` does not reject semicolons

历史摘要 · 未重新核验 · GitHub Advisory

undici vulnerable to downstream response desynchronization via retry interceptor

CVE-2026-16728

### Impact Undici's `interceptors.retry()` can deliver a response whose body length does not match the `Content-Length`

历史摘要 · 未重新核验 · GitHub Advisory