Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-75859 CodeWhale before 0.8.64 Arbitrary File Read via instructions
    crates.ionpm
  2. 7.8
    CVE-2026-75858 CodeWhale rlm_eval before 0.8.64 Remote Code Execution
    crates.ionpm
  3. 7.0
    CVE-2026-75857 CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact
    crates.ionpm
  4. 8.6
    CVE-2026-75856 CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU
    crates.ionpm
  5. 7.6
    CVE-2026-19869 Privilege Escalation via Dropped Field-Level @authentication
    npm maintainer advisory
  6. 5.9
    CVE-2026-84373 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
    npm
  7. 6.1
    CVE-2026-88057 Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
    npm
  8. 8.6
    CVE-2026-56677 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
    npm
  9. 6.5
    CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction
    npm
  10. 7.1
    CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
    npm
  11. 5.3
    CVE-2026-55090 Etherpad: Stored XSS in HTML export via unescaped attribute-pool values
    npm
  12. —
    GHSA-92hr-gmr6-h8cp Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling
    npm
  13. 7.5
    CVE-2026-92961 vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass
    npm
  14. 10.0
    CVE-2026-92960 vm2 before 3.11.6 Process-wide State Exposure via os and dns
    npm
  15. 9.8
    CVE-2026-47698 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
    npm
  16. 9.9
    CVE-2026-47686 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE
    npm
  17. 8.7
    CVE-2026-47683 vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
    npm
  18. 7.1
    CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
    npm
  19. 8.1
    CVE-2026-19693 extract-zip arbitrary file write outside the destination directory via a symlink at the final path component
    npm
  20. 7.5
    CVE-2026-69222 LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
    npm
  21. 8.7
    CVE-2026-61556 LiquidJS: An infinite loop vulnerability in `strip_html` filter
    npm
  22. 9.1
    CVE-2026-86542 knowns before 0.30.0 Path Traversal via Import Name
    npm maintainer advisory
  23. 8.1
    CVE-2026-86544 knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions
    npm maintainer advisory
  24. 7.5
    CVE-2026-86538 knowns before 0.30.0 Path Traversal via templateFile parameter
    npm maintainer advisory
  25. 7.2
    CVE-2026-86539 knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint
    npm maintainer advisory
  26. 9.8
    CVE-2026-86543 knowns before 0.30.0 Unauthenticated Management API Exposure
    npm maintainer advisory
  27. 8.3
    CVE-2026-86541 knowns before 0.30.0 Path Traversal via code.replace MCP action
    npm maintainer advisory
  28. 8.2
    CVE-2026-40345 deepmerge-ts: Stack exhaustion when merging recursive object graphs
    npm
  29. 7.5
    CVE-2026-104861 probe-image-size: Quadratic-time Denial of Service in the SVG Parser
    npm
  30. 8.1
    CVE-2026-18500 @fastify/jwt vulnerable to authorization bypass via global secret overriding the per-request key
    npm maintainer advisory