Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 7.8
    CVE-2026-86540 knowns before 0.30.0 Arbitrary Code Execution via LSP Binary
    npm
  2. 8.8
    CVE-2026-86439 knowns before 0.30.0 Path Traversal via MCP doc and memory tools
    npm
    EPSS 1.1% chance of exploitation in 30 days, percentile 65%
  3. 8.1
    CVE-2026-75021 fastify-cli vulnerable to remote code execution via ignored explicit Inspector bind address
    npm maintainer advisory
  4. 10.0
    GHSA-xm38-vjwp-qrg4 Code injection via unvalidated numeric/length constraints (minimum/maxItems/minLength) in zod, effect, and faker generators
    npm unreviewed · maintainers only
  5. 9.8
    GHSA-q8g3-2pxp-2gmw Code injection in @orval/mock (MSW) via unescaped response status key emitted in an unquoted expression position
    npm unreviewed · maintainers only
  6. 8.6
    GHSA-79f3-f442-cq2j Code injection through mismatched numeric `const` values in generated models
    npm unreviewed · maintainers only
  7. 8.1
    CVE-2026-96756 orval before 8.30.0 Code Injection via Factory Generation
    npm maintainer advisory
  8. 5.9
    GHSA-jmpc-3jgr-j7jv externalRefs.allow can be bypassed through HTTP redirects
    npm unreviewed · maintainers only
  9. 9.8
    CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection
    npm maintainer advisory
  10. 9.8
    CVE-2026-96759 orval before 8.29.0 Code Injection via operationId
    npm maintainer advisory
  11. 9.8
    CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data
    npm maintainer advisory
  12. 8.6
    GHSA-mxvj-m96h-8mf7 Import-time RCE from unescaped OpenAPI values in three generators
    npm unreviewed · maintainers only
  13. 9.8
    CVE-2026-96754 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path
    npm maintainer advisory
  14. 9.8
    CVE-2026-96757 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type
    npm maintainer advisory
  15. 8.1
    GHSA-j7p3-24q8-rm47 Code injection in @orval/mock (faker) via enum type-confusion emitting string members unquoted
    npm unreviewed · maintainers only
  16. 8.4
    CVE-2026-87794 bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination
    npm maintainer advisory
  17. 7.5
    GHSA-7q9c-hpx7-9cwm TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop
    npm
  18. 4.7
    CVE-2026-93981 hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped Strings
    npm
  19. 5.9
    CVE-2026-18149 undici vulnerable to Denial of Service via orphaned RetryHandler response body
    npm
  20. 3.7
    CVE-2026-18540 undici vulnerable to downstream response splitting via retry interceptor
    npm
  21. 7.5
    CVE-2026-19534 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
    npm
  22. 5.9
    CVE-2026-84890 undici vulnerable to Denial of Service via unbounded decompression of compressed responses
    npm
  23. 6.5
    CVE-2026-84933 undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
    npm
  24. 3.7
    CVE-2026-84947 undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
    npm
  25. 7.4
    CVE-2026-84961 undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
    npm
  26. 3.7
    CVE-2026-85008 undici vulnerable to caching and replay of unsafe HTTP method responses
    npm
  27. 7.4
    CVE-2026-85152 undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
    npm
  28. 5.9
    CVE-2026-85014 undici vulnerable to Denial of Service via WebSocketStream unclean close
    npm
  29. 5.9
    CVE-2026-85024 undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression
    npm
  30. —
    GHSA-pmh9-4rj3-c67g CSS Injection via unsanitized collaboration awareness color in CollaborationCaret
    npm unreviewed · maintainers only