Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-64641 Next.js: Denial of Service in App Router using Server Actions
    Next.jsnpm
  2. 7.5
    CVE-2026-44907 react-server-dom: Denial of Service in Server Functions
    Reactnpm
  3. 7.1
    CVE-2026-114077 Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4
    npm maintainer advisory
  4. 5.4
    CVE-2026-114079 Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpoint
    npm
  5. 8.1
    CVE-2026-114078 Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup
    npm maintainer advisory
  6. 8.5
    CVE-2026-73654 Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
    npm
  7. 7.7
    CVE-2026-114081 Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name
    npm
  8. 5.3
    CVE-2026-114086 Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpoint
    npm
  9. 8.1
    CVE-2026-114087 Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secrets
    npm
  10. 5.1
    CVE-2026-71498 node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript
    npm
  11. 8.2
    CVE-2026-96780 figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
    npm
  12. 6.8
    CVE-2026-73419 NextAuth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
    npm
  13. 9.1
    CVE-2026-73421 NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
    npm
  14. 9.1
    CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
    npm
  15. 7.5
    CVE-2026-73418 NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
    npm
  16. 7.5
    CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
    npm
  17. 7.5
    CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments
    npm
  18. 6.3
    GHSA-qw9h-448j-6rph AI SDK Codex Harness Tool Relay Authorization Bypass
    npm unreviewed · maintainers only
  19. 6.3
    GHSA-g48p-5rr5-8rgq AI SDK OpenCode Harness Tool Relay Authorization Bypass
    npm unreviewed · maintainers only
  20. 6.5
    CVE-2026-114088 Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO
    npm
  21. 6.5
    CVE-2026-73562 Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
    npmbitnami
  22. —
    GHSA-3f6p-5ww8-9rcr MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
    npm
  23. 5.9
    GHSA-rgwj-5xj2-c3m3 MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS
    npm
  24. 7.5
    CVE-2026-16221 fast-uri vulnerable to host confusion via literal backslash authority delimiter
    npm
  25. 7.6
    CVE-2026-55177 CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard
    npm
  26. 5.3
    CVE-2026-53496 ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes
    npm
  27. 6.2
    CVE-2026-54561 MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context_import via unvalidated filePath
    npm
  28. 5.0
    CVE-2026-54546 CloudTAK: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard
    npm
  29. 5.3
    CVE-2026-73422 Astro: Reflected XSS via unescaped View Transition animation properties
    npm
  30. 5.1
    CVE-2026-73423 Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
    npm