Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 8.4
    GHSA-575v-8hfq-m3mc Sandbox bind mounts could bypass parent-directory denylist checks
    npm unreviewed · maintainers only
  2. 8.8
    GHSA-wxh3-g47h-q3mc Host exec environment filtering could miss rustup startup variables
    npm unreviewed · maintainers only
  3. 8.8
    GHSA-mm9g-83wh-mhwj Isolated cron jobs could regain denied exec tools
    npm unreviewed · maintainers only
  4. 7.7
    GHSA-mgvr-6gvw-3rgr Sandbox exec-server HTTP requests could reach internal networks
    npm unreviewed · maintainers only
  5. 8.8
    GHSA-9969-8g9h-rxwm Host exec environment filtering could allow Git ext transport
    npm unreviewed · maintainers only
  6. 8.8
    GHSA-hjr6-g723-hmfm Host exec environment filtering could miss interpreter startup variables
    npm unreviewed · maintainers only
  7. 4.3
    GHSA-v4f6-x5g5-2g4g Native web search could ignore OpenClaw tool policy
    npm unreviewed · maintainers only
  8. 8.5
    CVE-2026-62197 OpenClaw < 2026.6.6 Policy Bypass via CDP Discovery
    npm
  9. 8.3
    GHSA-fh38-965w-f6c3 WhatsApp group IDs could satisfy elevated sender allowlists
    npm unreviewed · maintainers only
  10. 8.3
    GHSA-52xj-c9p8-78cv MCP loopback could expose owner-only tools to non-owner runs
    npm unreviewed · maintainers only
  11. 8.8
    GHSA-7vrr-rp4x-4g76 Plugin install commands could allow non-owner persistence
    npm unreviewed · maintainers only
  12. 4.9
    GHSA-wgq8-x5wm-g4rw Plugin install wrappers could skip install policy
    npm unreviewed · maintainers only
  13. 8.1
    GHSA-3pmr-x9g8-m55r Discord guild actions could skip cross-provider requester authorization
    npm unreviewed · maintainers only
  14. 7.1
    GHSA-v7hx-r36p-f68m Message mutations could skip requester authorization
    npm unreviewed · maintainers only
  15. 8.8
    GHSA-3fp5-v549-9v66 flock wrapper could bypass durable exec approval binding
    npm unreviewed · maintainers only
  16. 8.4
    GHSA-m38g-vpwj-mpg9 OpenShell mirror sync could follow remote symlink parents
    npm unreviewed · maintainers only
  17. 8.1
    CVE-2026-62188 OpenClaw < 2026.6.9 Feishu Authorization Bypass
    npm
  18. 8.1
    CVE-2026-62187 OpenClaw < 2026.6.9 Feishu tools Authorization Bypass
    npm
  19. 7.6
    GHSA-jhfx-v2j8-x3m6 OpenAI-compatible HTTP model overrides could miss admin authorization
    npm unreviewed · maintainers only
  20. 6.6
    CVE-2026-45822 decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
    npm
  21. 8.8
    CVE-2026-55607 Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
    npm
  22. 7.5
    CVE-2026-13676 fast-uri vulnerable to host confusion via failed IDN canonicalization
    npm
  23. 5.3
    CVE-2026-13149 brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    npm
  24. 7.5
    CVE-2026-62297 ag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS)
    npm
  25. 5.3
    CVE-2026-59871 node-tar: Process crash via PAX numeric path type confusion
    npm
  26. 7.5
    CVE-2026-59873 node-tar: Decompression/parse DoS via unlimited input
    npm
  27. 7.5
    CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace
    npm
  28. 5.3
    CVE-2026-50029 js-toml has silent type confusion via falsy-primitive duplicate-key bypass
    npm
  29. 8.3
    CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP
    npm
  30. 8.1
    GHSA-prpr-5gj3-qqhg @better-auth/sso: Four SSO flaws let an attacker sign in as another user
    npm unreviewed · maintainers only