Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 5.6
    CVE-2026-55663 mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)
    npmcrates.io
  2. 8.6
    CVE-2026-55557 browse-mcp: Arbitrary file write via unconfined download and state paths
    npm
  3. 7.5
    CVE-2026-55553 urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
    npm
  4. 9.5
    GHSA-2xp9-vwfh-vxw4 Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
    Next.jsnpm
  5. 9.0
    CVE-2026-75604 Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
    Next.jsnpm
    1 public exploit EPSS 2.1% chance of exploitation in 30 days, percentile 82%
  6. —
    GHSA-8qx3-8gm5-9cj2 pickem vulnerable to terminal escape-sequence injection via unsanitized item text
    npm
  7. 8.1
    CVE-2026-16231 hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass
    npm maintainer advisory
  8. 8.2
    CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses
    npm
  9. 6.1
    CVE-2026-84369 SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
    npm
  10. 6.5
    CVE-2026-76845 adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction
    npm
  11. 7.4
    CVE-2026-76844 webpack-dev-middleware before 7.4.6 and 8.3.0 Path Traversal via Non-Slash-Terminated publicPath
    npm
  12. 9.4
    CVE-2026-78207 exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization
    npm maintainer advisory
  13. 7.5
    CVE-2026-78208 exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename
    npm maintainer advisory
  14. 8.2
    CVE-2026-78209 exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values
    npm maintainer advisory
  15. 7.5
    CVE-2026-78206 exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression
    npm maintainer advisory
  16. 7.5
    CVE-2026-75931 fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
    npm
  17. 7.5
    CVE-2026-75899 fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
    npm
  18. 7.5
    CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
    npm
  19. 7.5
    CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization
    npm
  20. 6.9
    CVE-2026-83611 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
    npm
  21. 8.7
    CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
    npm
  22. 8.7
    CVE-2026-83618 xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
    npm
  23. 8.7
    CVE-2026-83617 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
    npm
  24. 6.3
    CVE-2026-83610 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
    npm
  25. 8.7
    CVE-2026-83616 xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
    npm
  26. 8.7
    CVE-2026-83608 xmldom: DocType `name` Injection Bypasses requireWellFormed
    npm
  27. 8.7
    CVE-2026-83614 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
    npm
  28. 8.7
    CVE-2026-83619 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
    npm
  29. 8.7
    CVE-2026-83612 xmldom: HTML raw-text closing-tag case mismatch causes output amplification
    npm
  30. 8.7
    CVE-2026-83615 xmldom: Quadratic-memory consumption
    npm