Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 8.8
    CVE-2026-65595 n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange
    npm
  2. 6.5
    CVE-2026-65594 n8n before 2.30.1 Missing OAuth Authorization Check
    npm
  3. 5.4
    CVE-2026-65593 n8n before 1.123.64, 2.29.8, and 2.30.1 SSRF via Dynamic Node Parameters
    npm
  4. 5.4
    CVE-2026-65592 n8n before 1.123.64 Stored DOM XSS via cachedResultUrl
    npm
  5. 8.8
    CVE-2026-65591 n8n before 1.123.64 Sanitizer Bypass Remote Code Execution
    npm
  6. 9.8
    CVE-2026-65590 n8n before 2.30.1 Shell Sandbox Bypass on Linux Windows
    npm
  7. 6.5
    CVE-2026-65589 n8n before 1.123.64 Credential Exposure via LLM Node Execution Data
    npm
  8. 8.8
    CVE-2026-65016 n8n before 1.123.64, 2.29.8, and 2.30.1 Privilege Escalation via SSO Instance-Role
    npm
  9. 8.8
    CVE-2026-65015 n8n before 2.30.1 Privilege Escalation via run_node_tool
    npm
  10. 5.3
    CVE-2026-65014 n8n before 2.28.0 Authentication Bypass via test-webhook
    npm
  11. 5.3
    CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
    npm
  12. 10.0
    CVE-2026-72851 Budibase before 3.40.0 SQL Injection via Unauthenticated Webhook
    npm maintainer advisory
  13. 9.1
    CVE-2026-72850 Budibase before 3.40.0 Arbitrary File Write via Path Traversal
    npm maintainer advisory
  14. 7.6
    CVE-2026-72853 Budibase before 3.40.0 SQL Injection via Oracle connector
    npm maintainer advisory
  15. 7.5
    CVE-2026-15074 @fastify/static vulnerable to route guard bypass via path traversal
    npm
  16. 7.5
    CVE-2026-45820 fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives
    npm
  17. 8.1
    CVE-2026-102344 Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server
    npm maintainer advisory
  18. 7.5
    GHSA-p2w6-cmq4-qjfj Denial of Service in Server Functions
    npm unreviewed · maintainers only
  19. 7.5
    CVE-2026-73566 node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
    npm
  20. 7.5
    CVE-2026-100409 OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
    npm
  21. 7.5
    CVE-2026-73089 Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM
    npm
  22. 7.5
    CVE-2026-73088 Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)
    npm
  23. 6.5
    CVE-2026-64649 Next.js: Server-Side Request Forgery in Server Actions on Custom Servers
    Next.jsnpm
  24. 5.4
    CVE-2026-64647 Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies
    Next.jsnpm
  25. 5.4
    CVE-2026-64648 Next.js: Response Body Cache Confusion for Requests Containing Bodies
    Next.jsnpm
  26. 5.3
    CVE-2026-64646 Next.js: Unbounded Server Action payload in Edge runtime
    Next.jsnpm
  27. 5.3
    CVE-2026-64644 Next.js: Denial of Service in the Image Optimization API using SVGs
    Next.jsnpm
  28. 6.1
    CVE-2026-64645 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
    Next.jsnpm
  29. 5.3
    CVE-2026-64643 Next.js: Unauthenticated Disclosure of Internal Server Function endpoints
    Next.jsnpm
  30. 8.2
    CVE-2026-64642 Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
    Next.jsnpm