Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    GHSA-qcc9-jh8q-47vh @fastify/middie standalone engine vulnerable to Denial of Service via malformed percent-encoded paths
    npm unreviewed · maintainers only
  2. 9.1
    GHSA-2v46-jxjm-7q3v @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values
    npm unreviewed · maintainers only
  3. 8.6
    GHSA-jwgx-mp9m-jwcr Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin
    npm unreviewed · maintainers only
  4. 6.5
    CVE-2026-58191 Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
    npm
  5. 7.1
    GHSA-4pqj-3c56-5fqq Workspace dotenv files could override provider credentials
    npm unreviewed · maintainers only
  6. 8.8
    GHSA-8f46-3xx3-8c9m Node exec approvals could use different gateway and node environments
    npm unreviewed · maintainers only
  7. 8.0
    GHSA-vr7j-7684-7gm5 HTTP Canvas responses could forge trusted A2UI actions
    npm unreviewed · maintainers only
  8. 7.1
    GHSA-wxm8-ghhq-q688 MS Teams safeFetch could race DNS rebinding checks
    npm unreviewed · maintainers only
  9. 5.0
    GHSA-j4cx-jvq7-79vm Trajectory export could skip broad credential redaction
    npm unreviewed · maintainers only
  10. 6.5
    GHSA-4xwj-mcc7-x7x5 Remote media URLs could slow-read exhaust tool workers
    npm unreviewed · maintainers only
  11. 8.8
    GHSA-cf2p-f286-mphf Identity-bearing HTTP callers could reach admin-scoped tools
    npm unreviewed · maintainers only
  12. 8.8
    GHSA-34mr-7r3m-gfg7 Exec allowlist glob matching could allow traversal bypasses
    npm unreviewed · maintainers only
  13. 7.7
    GHSA-2x93-h3hg-2xfp Browser snapshot routes could miss post-navigation SSRF checks
    npm unreviewed · maintainers only
  14. 8.5
    GHSA-x863-pqjw-hmgf Browser act route could miss current-tab URL checks
    npm unreviewed · maintainers only
  15. 5.4
    GHSA-mhm4-93fw-4qr2 Skill command dispatch could skip effective tool policy
    npm unreviewed · maintainers only
  16. 5.4
    GHSA-7w4v-g4m6-j88v [AgentGG] MS Teams allowFrom could bind to mutable display names
    npm unreviewed · maintainers only
  17. 8.8
    GHSA-hx85-fgcw-9vrc Device-pair approval could expose node system.run early
    npm unreviewed · maintainers only
  18. 7.8
    GHSA-rh6r-vvfc-86jq Setup-mode discovery could load untrusted workspace plugins
    npm unreviewed · maintainers only
  19. 5.4
    GHSA-fh8v-vgcv-pwh4 ClickClack allowFrom could allow non-allowlisted commands
    npm unreviewed · maintainers only
  20. 5.3
    GHSA-5p6w-wmh3-frfr WebSocket auth attempts could avoid non-browser rate limits
    npm unreviewed · maintainers only
  21. 7.1
    GHSA-724r-v4wf-mqc5 Hooks allowedAgentIds could be bypassed with blank agent IDs
    npm unreviewed · maintainers only
  22. 8.8
    GHSA-8v95-qqcm-qp9h device.pair.approve could bypass role-management checks
    npm unreviewed · maintainers only
  23. 8.8
    GHSA-7jx6-764p-fgg9 QQBot exec approvals could allow non-allowlisted senders
    npm unreviewed · maintainers only
  24. 5.0
    GHSA-fwgr-fpv9-vf5x QQBot media upload could reach untrusted remote URLs
    npm unreviewed · maintainers only
  25. 6.5
    GHSA-prwc-c6w5-mmgr Bot Framework serviceUrl validation could leak bot tokens
    npm unreviewed · maintainers only
  26. 6.5
    GHSA-v54h-q2vx-vgg4 MS Teams outbound requests could leak Bot Framework tokens
    npm unreviewed · maintainers only
  27. 8.1
    GHSA-wp73-f3gg-w4vr ClickClack agent-mode dispatch could ignore toolsAllow
    npm unreviewed · maintainers only
  28. 6.5
    CVE-2026-62208 OpenClaw < 2026.6.5 Authorization Header Forwarding via SSE
    npm
  29. 7.1
    GHSA-f6p7-6326-vf7v Discord moderation actions could miss trusted requester checks
    npm unreviewed · maintainers only
  30. 7.1
    GHSA-p5xh-frrh-cmgj MS Teams message actions could miss requester authorization
    npm unreviewed · maintainers only