Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 9.1
    CVE-2026-46649 Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
    npm maintainer advisory
  2. 2.5
    CVE-2026-49449 Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows
    npm maintainer advisory
  3. 7.0
    CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
    npm maintainer advisory
  4. 3.8
    CVE-2026-100620 Capgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account
    npm maintainer advisory
  5. 9.8
    CVE-2026-88899 knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
    npm maintainer advisory
  6. 6.5
    CVE-2026-88938 knowns through 0.33.0 Path Traversal via code.find MCP tool
    npm maintainer advisory
  7. 8.8
    CVE-2026-88937 knowns through 0.33.0 Path Traversal via Template Engine
    npm maintainer advisory
  8. 7.1
    GHSA-2q42-4q24-7rgv OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree
    npm
  9. 7.5
    CVE-2026-86075 n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
    npm
  10. 8.8
    CVE-2026-86076 n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution
    npm
  11. 6.5
    CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
    npm
  12. 6.5
    CVE-2026-86078 n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
    npm
  13. 6.5
    CVE-2026-86079 n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
    npm
  14. 5.3
    CVE-2026-86080 n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open
    npm
  15. 7.1
    CVE-2026-86081 n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
    npm
  16. 6.5
    CVE-2026-86082 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
    npm
  17. 8.8
    CVE-2026-86083 n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
    npm
  18. 5.5
    CVE-2026-86084 n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
    npm
  19. 4.9
    CVE-2026-86085 n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints
    npm
  20. 4.9
    CVE-2026-86993 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
    npm
  21. 4.3
    CVE-2026-86994 n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter
    npm
  22. 4.3
    CVE-2026-86995 n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
    npm
  23. 5.4
    CVE-2026-86996 n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
    npm
  24. 7.1
    CVE-2026-86074 n8n: Instance AI Credential Setup Accepts Unvalidated Probe URL from Fetched Content
    npm
  25. 7.6
    CVE-2026-86073 n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
    npm
  26. 9.6
    CVE-2026-82533 DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing
    npm
    EPSS 1.2% chance of exploitation in 30 days, percentile 69%
  27. 7.4
    CVE-2026-103921 GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
    npm
  28. 8.2
    CVE-2026-104852 GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
    npm
  29. 6.5
    CVE-2026-86597 Sensitive information written to logs by Snowflake drivers
    npmpypigomaven
  30. 9.4
    CVE-2026-76969 Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
    npm