Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 8.7
    CVE-2026-83607 xmldom: Element name injection via createElement() bypasses requireWellFormed
    npm
  2. 7.1
    CVE-2026-71553 ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS
    npm
  3. 5.4
    CVE-2026-84371 ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
    npm
  4. 6.5
    GHSA-rgg4-476q-xgcg @apostrophecms/form: File attachments stored and publicly accessible before CAPTCHA validation is enforced
    npm unreviewed · maintainers only
  5. 6.5
    CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal
    npm
  6. 6.1
    CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
    npm
  7. 6.5
    CVE-2026-63669 ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
    npm
  8. 6.1
    GHSA-73hm-ghh3-g73r Mutation XSS in sanitize-html via SVG/MathML foreign-content raw-text confusion
    npm unreviewed · maintainers only
  9. 5.3
    GHSA-xmpp-f9v3-r7qh Incomplete fix for CVE-2026-39857 — publicApiProjection choices/counts guard bypassable via relationship slug-builder aliases
    npm unreviewed · maintainers only
  10. 7.5
    CVE-2026-114123 D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet
    npm maintainer advisory
  11. 8.1
    CVE-2026-80192 better-auth SSO before 1.6.27 Domain Ownership Authentication Bypass
    npm maintainer advisory
  12. 8.8
    CVE-2026-73222 Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)
    npm
  13. 10.0
    CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP
    npm maintainer advisory
    EPSS 2.4% chance of exploitation in 30 days, percentile 84%
  14. 4.8
    GHSA-wpj8-6fxv-7g8r Argument injection in `GitClient` methods that pass values to git
    npm unreviewed · maintainers only
  15. 7.0
    CVE-2026-58230 Multiple vulnerabilities in SAP Business AI Platform (Approuter)
    npm
  16. 8.2
    CVE-2026-85730 smol-toml: Denial of Service via malformed TOML documents
    npm
  17. 5.4
    CVE-2026-114074 Trigger.dev before 4.5.10 Webhook SSRF Protection Bypass via 198.18.0.0/15 Range
    npm maintainer advisory
  18. 8.4
    GHSA-xmr7-549p-98w3 Prototype Pollution via constructor.prototype Bypasses CVE-2026-54639 Patch
    npm unreviewed · maintainers only
  19. 8.4
    CVE-2026-80427 bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter
    npm maintainer advisory
  20. —
    GHSA-w9hm-4m3m-fxmm ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633
    npm
  21. 7.5
    GHSA-423g-23ch-w7c6 @fastify/static vulnerable to route guard bypass via non-canonical path segments
    npm unreviewed · maintainers only
  22. 2.3
    CVE-2026-105799 LangChain: RediSearch Filter Injection via Unescaped Tag/Text Values
    npm
  23. 9.0
    CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
    npm
  24. 4.3
    CVE-2026-70596 Ghost: Cross-Site Scripting in Feature Image Captions
    npmbitnami
  25. 4.0
    CVE-2026-70595 Ghost: Server-Side Request Forgery Mitigation Issue
    npmbitnami
  26. 6.5
    CVE-2026-77076 n8n before 1.123.69 Credential Leak via GraphQL Node Error
    npm maintainer advisory
  27. 7.6
    CVE-2026-77072 n8n before 1.123.69 Stored XSS via Form Completion Page
    npm maintainer advisory
  28. 9.8
    CVE-2026-77071 n8n before 1.123.69 PostgREST Filter Injection via Supabase
    npm maintainer advisory
  29. 9.8
    CVE-2026-77070 n8n before 1.123.69 NoSQL Injection via MongoDB Node
    npm maintainer advisory
  30. 8.8
    CVE-2026-77068 n8n before 2.34.1 Remote Code Execution via Path Traversal
    npm maintainer advisory