Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 8.6
    CVE-2026-44116 OpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL Validation
    npm
  2. 4.3
    CVE-2026-44997 OpenClaw < 2026.4.22 - Security Envelope Constraint Bypass in ACP Child Sessions
    npm
  3. 7.7
    CVE-2026-44113 OpenClaw < 2026.4.22 - Time-of-Check/Time-of-Use Race Condition in OpenShell FS Bridge
    npm
  4. 7.8
    CVE-2026-44118 OpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Token Header
    npm
  5. 9.6
    CVE-2026-44112 OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes
    npm
    EPSS 7.3% chance of exploitation in 30 days, percentile 94%
  6. 5.0
    CVE-2026-45003 OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files
    npm
  7. 8.8
    CVE-2026-44115 OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlist
    npm
  8. 5.3
    CVE-2026-44994 OpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint
    npm
  9. 5.3
    CVE-2026-41495 n8n-MCP Logs Sensitive Request Data on Unauthorized /mcp Requests
    npm
  10. 7.5
    CVE-2026-41311 LiquidJS is vulnerable to Denial of Service via circular block reference in layout
    npm
  11. 7.5
    CVE-2026-41680 Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer
    npm
  12. 4.3
    CVE-2026-6874 ericc-ch copilot-api Header token dns rebinding
    npm
  13. 8.1
    CVE-2026-42075 Evolver: Path Traversal via `--out` flag in `fetch` command allows Arbitrary File Write
    npm
  14. 9.8
    CVE-2026-42076 Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution
    npm
    EPSS 1.7% chance of exploitation in 30 days, percentile 77%
  15. 5.2
    CVE-2026-42077 Evolver: Prototype Pollution via `Object.assign()` in mailbox store operations
    npm
  16. 6.9
    CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name
    npm
  17. 8.1
    CVE-2026-42349 Clerk: Authorization bypass when combining organization, billing, or reverification checks
    Next.jsReactnpm
  18. 7.5
    CVE-2026-41886 locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor
    npm
  19. 6.5
    CVE-2026-41885 Path traversal / URL injection via unsanitised lng/ns/projectId/version in i18next-locize-backend
    npm
  20. 8.6
    CVE-2026-41683 HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header
    npm
  21. 7.5
    CVE-2026-41640 NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading
    npm
    EPSS 1.9% chance of exploitation in 30 days, percentile 79%
  22. 7.2
    CVE-2026-41641 NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call
    npm
    EPSS 1.8% chance of exploitation in 30 days, percentile 79%
  23. 6.4
    CVE-2026-41591 Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping
    npm
  24. 8.2
    CVE-2026-41693 i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite
    npm
  25. 4.7
    CVE-2026-41692 i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes
    npm
  26. 8.6
    CVE-2026-41690 Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters
    npm
  27. —
    GHSA-2r2p-4cgf-hv7h engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection
    npm
  28. —
    GHSA-9237-rg5p-rhfw @saltcorn/data: Tenant user role is used for tenant creation role check
    npm
  29. 3.7
    CVE-2026-44996 OpenClaw < 2026.4.15 - Arbitrary Local File Read via Webchat Audio Embedding
    npm
  30. 4.2
    CVE-2026-44991 OpenClaw < 2026.4.21 - Authorization Bypass in Owner-Enforced Commands via Wildcard Channel Senders
    npm