Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 9.8
    CVE-2026-54687 n8n-nodes-sqlite3: Path traversal via user-controlled database file path (db_path parameter)
    npm
  2. 5.3
    CVE-2026-81176 Svelte devalue: DoS via malformed input
    npm
  3. 9.8
    GHSA-26w7-cxv4-gfx2 Astro: Remote code execution through AVIF image optimization
    npm
  4. 6.3
    CVE-2026-102983 Astro: Netlify Image CDN allowlist bypass enables SSRF
    npm
  5. 6.3
    CVE-2026-84376 Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
    npm
  6. 8.2
    CVE-2026-102984 Astro: Malformed port in the Host header can crash the Node adapter
    npm
  7. 8.9
    CVE-2026-114112 Sharp before 0.35.4 RCE via bundled libheif AVIF decoding
    npm
  8. 7.7
    CVE-2026-88883 Renovate before 44.14.4 TLS Private Key Log Sanitisation
    npm maintainer advisory
  9. 8.6
    CVE-2026-88880 Renovate before 44.11.3 Credential Exfiltration via Link Header
    npm maintainer advisory
  10. 8.6
    CVE-2026-88881 Renovate before 44.11.3 Credential Exfiltration via Link Header
    npm maintainer advisory
  11. 8.6
    CVE-2026-88882 Renovate before 44.11.2 Credential Exfiltration via Link Header
    npm maintainer advisory
  12. 8.6
    CVE-2026-88887 Renovate before 44.11.2 Credential Exfiltration via Link Header
    npm maintainer advisory
  13. 7.0
    CVE-2026-88888 Renovate before 44.14.7 Command Injection via Mix organization
    npm maintainer advisory
  14. 7.8
    CVE-2026-88889 Renovate before 44.14.7 Command Injection via distributionType
    npm maintainer advisory
    EPSS 1.0% chance of exploitation in 30 days, percentile 64%
  15. 7.8
    CVE-2026-88886 Renovate before 44.14.7 Command Injection via gradle-wrapper
    npm maintainer advisory
  16. 7.0
    CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName
    npm maintainer advisory
  17. 5.8
    CVE-2026-88884 Renovate before 44.3.1 Authentication Bypass via Digest Updates
    npm maintainer advisory
  18. 6.1
    CVE-2026-88060 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
    npm
  19. 6.1
    CVE-2026-88058 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
    npm
  20. 9.1
    CVE-2026-88056 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR
    npm
  21. 7.5
    CVE-2026-84375 js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
    npm
  22. 5.3
    GHSA-r3ph-w7gj-g6xm js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
    npm
  23. 8.5
    CVE-2026-54606 SunEditor: DOM XSS in SunEditor Embed Plugin via External Script Element After Iframe Embed
    npm
  24. 8.6
    CVE-2026-54511 @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys
    npm
  25. —
    GHSA-j95f-988m-3j2f Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing
    npm
  26. —
    GHSA-cp6q-959q-f8rh Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes
    npm
  27. 5.3
    CVE-2026-84364 Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
    npm
  28. 6.5
    CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
    npm
  29. 5.9
    CVE-2026-84363 Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
    npm
  30. 7.1
    CVE-2026-55609 sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state
    npm