Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. —
    GHSA-5c7w-4wm3-85vw @asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection
    npm
  2. 8.7
    CVE-2026-50288 @asymmetric-effort/specifyjs: URL parse failure silently allows request
    npm
  3. 9.8
    CVE-2026-64682 AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name
    npm maintainer advisory
  4. 5.3
    CVE-2026-59868 js-yaml: YAML merge-key chains can force quadratic CPU consumption
    npm
  5. 7.5
    CVE-2026-59869 js-yaml: YAML merge-key chains can force quadratic CPU consumption
    npm
  6. 9.3
    CVE-2026-64670 Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit
    npm maintainer advisory
  7. 7.5
    CVE-2026-56669 Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict
    npm
  8. 7.5
    CVE-2026-59870 js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing
    npm
  9. 7.5
    CVE-2026-59887 linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text
    npm
  10. 8.1
    CVE-2026-50143 Actor MCP path authority injection leaks Apify token
    npm
  11. 7.2
    CVE-2026-58263 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
    npm
  12. 6.3
    CVE-2026-54756 Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMerge
    npm
  13. 7.3
    CVE-2026-13760 OS Command Injection in aws-cdk-lib Docker Bundling
    npm
    EPSS 1.2% chance of exploitation in 30 days, percentile 67%
  14. 5.5
    CVE-2026-49988 Repomix: attach_packed_output can bypass file-read secret scanning for supported local files
    npm
  15. 8.8
    CVE-2026-49987 Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection
    npm
  16. 8.6
    CVE-2026-49864 wetty vulnerable to DOM XSS via file-download filename
    npm
  17. 7.4
    CVE-2026-49857 auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback
    npm
  18. 4.3
    CVE-2026-49856 @jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization
    npm
  19. 7.8
    CVE-2026-63496 augment-vir: Shell Command Injection in `grep()` via Unsanitized `searchPattern`
    npm maintainer advisory
  20. 8.2
    CVE-2026-59731 Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
    npm
  21. 5.3
    CVE-2026-63478 isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout
    npm
  22. 4.3
    CVE-2026-63476 isomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)
    npm maintainer advisory
  23. 4.3
    CVE-2026-63475 isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)
    npm
  24. 8.8
    CVE-2026-63395 isomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)
    npm
  25. 8.2
    CVE-2026-63376 toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
    npm
  26. 8.6
    CVE-2026-48795 Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser
    npm
  27. 5.9
    CVE-2026-63402 i18next: Shared built-in corruption through inherited-key deepExtend recursion
    npm maintainer advisory
  28. 8.8
    CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
    npm
  29. 5.3
    CVE-2026-63386 js-toml: Uncontrolled recursion in `load()` causes `RangeError` (stack exhaustion) on deeply nested input
    npm maintainer advisory
  30. 7.5
    CVE-2026-63341 Aedes has Uncaught Exception and Uncontrolled Resource Consumption
    npm maintainer advisory