Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 6.9
    CVE-2026-85062 Colord: Slow rejection of oversized malformed color strings
    npm
  2. 8.8
    CVE-2026-85169 n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak
    npm maintainer advisory
  3. 9.9
    CVE-2026-85165 n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement
    npm maintainer advisory
  4. 6.5
    CVE-2026-85171 n8n before 1.123.73 Credential Exposure via Error Logging
    npm maintainer advisory
  5. 8.8
    CVE-2026-85168 n8n before 1.123.73 Remote Code Execution via Git Node
    npm maintainer advisory
  6. 6.5
    CVE-2026-85166 n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node
    npm maintainer advisory
  7. 6.5
    CVE-2026-85170 n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes
    npm maintainer advisory
  8. 6.5
    CVE-2026-85167 n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
    npm maintainer advisory
  9. 4.3
    CVE-2026-85173 n8n before 2.36.2 Missing Authorization via Insights API
    npm maintainer advisory
  10. 6.4
    CVE-2026-85172 n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
    npm maintainer advisory
  11. 3.7
    CVE-2026-84367 joi: object().rename() with a template target can set the validated object's prototype
    npm
  12. 10.0
    CVE-2026-85061 MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
    npm
  13. 7.5
    CVE-2026-103936 libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners
    npm maintainer advisory
  14. 7.5
    CVE-2026-86040 libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS
    npm maintainer advisory
  15. 7.5
    CVE-2026-77384 libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows remote resource exhaustion
    npm maintainer advisory
  16. 8.3
    GHSA-c7hr-448w-65px MeshCentral has unsanitized data fields
    npm
  17. 6.1
    CVE-2026-16732 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
    npm
  18. 5.4
    CVE-2026-18504 fastify vulnerable to schema validation bypass via root primitive coercion mismatch
    npm
  19. 6.2
    CVE-2026-107392 music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of CVE-2026-32256)
    npm
  20. 7.5
    CVE-2026-55178 GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
    npmpypi
  21. 4.3
    CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables
    npm
  22. 6.3
    CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery
    npm
  23. 6.3
    CVE-2026-63643 MagicMirror: ssrf calendar .js
    npm
  24. 2.3
    CVE-2026-63641 MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions
    npm
  25. 7.5
    GHSA-2mf3-mr2r-r4vf @rhinostone/swig: arbitrary local file read via include/extends path traversal
    npm
  26. 7.5
    CVE-2026-75915 CodeWhale before 0.8.64 Environment Variable Leak via js_execution
    crates.ionpm
  27. 7.5
    CVE-2026-75914 CodeWhale before 0.8.64 Path Traversal via image_analyze symlink
    crates.ionpm
  28. 9.3
    CVE-2026-75913 CodeWhale before 0.8.64 Argument Injection via git_show
    crates.ionpm
  29. 7.4
    CVE-2026-75912 CodeWhale before 0.8.64 Argument Injection via git_blame
    crates.ionpm
  30. 7.8
    CVE-2026-75911 CodeWhale before 0.8.64 Remote Code Execution via allow_shell
    crates.ionpm