Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 8.2
    CVE-2026-55575 LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
    npm
  2. 7.3
    CVE-2026-14722 tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injection
    npm
  3. 7.2
    CVE-2026-64671 Stored XSS in the @waline/client UserList widget via an unescaped commenter link field
    npm maintainer advisory
  4. 4.8
    CVE-2026-59876 protobufjs: Text Format string map parsing can mutate returned map object prototype
    npm
  5. 5.3
    CVE-2026-59877 protobufjs: Denial of Service via infinite loop in .proto option parsing
    npm
  6. 5.3
    CVE-2026-14631 webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
    npm
  7. 4.7
    CVE-2026-14620 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
    npm
    1 public exploit
  8. 6.9
    CVE-2026-65957 Helio: Dashboard sideband CORS origin allowlist matches hostnames by prefix, admitting attacker-controlled origins in open mode
    npm maintainer advisory
  9. 8.7
    CVE-2026-65843 sync-rpc: Arbitrary remote code execution vulnerability
    npm maintainer advisory
  10. 6.9
    CVE-2026-65833 iopress: buffer over-read in chunked HTTP parser
    npm maintainer advisory
  11. 7.5
    CVE-2026-59892 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
    npm
  12. 7.5
    CVE-2026-58505 geojson-vt: Uncontrolled Recursion in Nested GeoJSON GeometryCollection
    npm maintainer advisory
  13. 4.3
    CVE-2026-82257 SvelteKit before 2.69.1 Prototype Pollution via File Input
    npm
  14. 5.3
    CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form
    npm
  15. 7.5
    CVE-2026-49353 9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
    npm
  16. 9.8
    CVE-2026-49352 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass
    npm
  17. —
    GHSA-x4hg-hfwf-p9mw @asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation
    npm
  18. —
    GHSA-322x-v876-g883 @asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write
    npm
  19. 9.8
    CVE-2026-59800 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint
    npm
    EPSS 2.1% chance of exploitation in 30 days, percentile 81%
  20. 5.3
    CVE-2026-123808 Nuxt UI: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration
    npm
  21. —
    GHSA-f9ff-5x35-7gfw Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)
    npm
  22. 8.8
    CVE-2026-49255 electerm: Command Injection in File System Operations (rmrf, mv, cp)
    npm
  23. 7.1
    CVE-2026-49253 electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling
    npm
  24. 8.7
    CVE-2026-49250 Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields
    npm
  25. —
    GHSA-vv65-f55v-xm6g Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)
    npm
  26. 5.3
    CVE-2026-50290 @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString
    npm
  27. —
    GHSA-j5qp-p44g-2m49 @asymmetric-effort/specifyjs: No redirect target validation in secureFetch
    npm
  28. —
    GHSA-2944-57xv-2682 @asymmetric-effort/specifyjs: `data:` URI allowed without size restriction
    npm
  29. —
    GHSA-xw57-23p8-9wc5 @asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)
    npm
  30. —
    GHSA-qcr8-x557-7cp3 @asymmetric-effort/specifyjs: Production console warnings may leak internal framework state
    npm