Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 7.3
    CVE-2026-77075 n8n before 1.123.69 Expression Injection via Resource Locator
    npm maintainer advisory
  2. 7.6
    CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution
    npm maintainer advisory
  3. 8.8
    CVE-2026-77084 n8n before 1.123.69 Remote Code Execution via Git Node Configuration Values
    npm maintainer advisory
  4. 8.8
    CVE-2026-77080 n8n before 1.123.69 Arbitrary File Read and Write via Snowflake
    npm maintainer advisory
  5. 8.8
    CVE-2026-77079 n8n before 2.34.1 Authorization Bypass via Custom Role Deletion
    npm maintainer advisory
  6. 4.3
    CVE-2026-77073 n8n before 2.34.1 Cross-Project Credential Access via MCP
    npm maintainer advisory
  7. 6.5
    CVE-2026-77074 n8n before 1.123.69 SSRF via Edit Image Node
    npm maintainer advisory
  8. 6.5
    CVE-2026-77085 n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool
    npm maintainer advisory
  9. 5.9
    CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution
    npm maintainer advisory
  10. 4.3
    CVE-2026-77082 n8n before 1.123.69 ReDoS via Filter and Switch Node
    npm maintainer advisory
  11. 7.1
    CVE-2026-77081 n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node
    npm maintainer advisory
  12. 4.3
    CVE-2026-77069 n8n before 1.123.69 SSRF Protection Bypass via OAuth2
    npm maintainer advisory
  13. 8.1
    CVE-2026-126539 Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
    npm maintainer advisory
  14. 8.0
    GHSA-pvh8-4vwp-j58p Arbitrary File Write via Symlink in isomorphic-git
    npm unreviewed · maintainers only
  15. 6.7
    CVE-2026-70594 Ghost: Session Fixation in Ghost Admin
    npmbitnami
  16. 6.6
    CVE-2026-70593 Ghost: Theme Upload Path Traversal
    npmbitnami
  17. 5.5
    CVE-2026-70592 Ghost: Database Backup Path Traversal
    npmbitnami
  18. 4.1
    CVE-2026-70591 Ghost: Server-Side Request Forgery in Image Fetching
    npmbitnami
  19. 4.8
    CVE-2026-70590 Ghost: Blind Password Hash Disclosure in Ghost Admin API
    npmbitnami
  20. 4.8
    CVE-2026-70589 Ghost: Archived Offers can be Redeemed
    npmbitnami
  21. 5.0
    CVE-2026-70588 Ghost: Cross-Site Scripting in Universal Import
    npmbitnami
  22. 10.0
    CVE-2026-70478 Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
    npm
  23. 9.8
    CVE-2026-70477 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    npm
  24. 8.2
    CVE-2026-70476 Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
    npm
  25. 5.3
    CVE-2026-73603 Flowise before 3.1.4 Credential Abuse via Text-to-Speech
    npm
  26. 6.5
    CVE-2026-70475 Flowise: Missing Authorization on Execution Update Endpoint
    npm
  27. 8.1
    CVE-2026-70474 Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
    npm
  28. 6.5
    CVE-2026-73604 Flowise before 3.1.3 Credential Exposure via API
    npm
  29. 8.5
    CVE-2026-70473 Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
    npm
  30. 8.8
    CVE-2026-70472 Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
    npm