Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 4.2
    CVE-2026-18165 @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies
    npm maintainer advisory
  2. 7.5
    CVE-2026-18549 @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit
    npm maintainer advisory
  3. 7.5
    CVE-2026-19474 @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload
    npm maintainer advisory
  4. 5.3
    CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints
    npm
  5. 8.4
    CVE-2026-55157 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info
    npm
  6. 7.1
    CVE-2026-35219 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist
    npm
  7. 6.5
    CVE-2026-73846 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
    npm
  8. 5.3
    CVE-2026-73845 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
    npm
  9. 3.7
    CVE-2026-73844 CKAN MCP Server: Information disclosure via verbose error reflection
    npm
  10. 8.6
    CVE-2026-86775 knowns before 0.30.0 Path Traversal via Document API
    npm maintainer advisory
  11. —
    GHSA-w2f6-j622-j3mg Quadratic-time ReDoS in toNumber() for decimals with a long internal zero-run
    npm unreviewed · maintainers only
  12. 7.1
    CVE-2026-82246 Budibase Server before 3.41.3 SSRF via Query Import
    npm maintainer advisory
  13. 8.1
    CVE-2026-82245 Budibase before 3.41.3 Missing Authorization License Management
    npm maintainer advisory
  14. 9.1
    CVE-2026-82244 Budibase before 3.41.3 Remote Code Execution via Plugin eval()
    npm maintainer advisory
  15. 7.6
    CVE-2026-82243 Budibase Server before 3.41.3 SSRF with Credential Leakage
    npm maintainer advisory
  16. 7.7
    CVE-2026-82242 Budibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization
    npm maintainer advisory
  17. 8.1
    CVE-2026-82239 Budibase before 3.41.3 Authorization Bypass via datasources/query
    npm maintainer advisory
  18. 7.1
    CVE-2026-82241 Budibase backend-core SSRF via incomplete default blacklist
    npm maintainer advisory
  19. 8.1
    CVE-2026-82240 Budibase before 3.41.3 Privilege Escalation via User Update API
    npm maintainer advisory
  20. 5.8
    CVE-2026-55102 hashi-vault-js: Vault token and secret values exposed in thrown errors
    npm
  21. 6.8
    CVE-2026-55088 Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
    npm
  22. 4.2
    CVE-2026-55086 Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
    npm
  23. 6.1
    CVE-2026-55087 Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)
    npm
  24. 9.8
    CVE-2026-73487 Flowise before 3.1.3 Prompt Injection RCE via CSV Agent
    npm
  25. 8.8
    CVE-2026-73483 Flowise before 3.1.3 Sandbox Escape via Puppeteer
    npm
  26. 6.6
    CVE-2026-45819 baseline-browser-mapping process termination on invalid input causes denial of service
    npm
  27. 7.5
    CVE-2026-19481 @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
    npm
  28. 7.5
    CVE-2026-19484 @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
    npm
  29. 8.7
    CVE-2026-83606 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
    npm
  30. 8.7
    CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
    npm