Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 4.3
    CVE-2026-100583 OpenClaw Discord before 2026.7.1 Authorization Bypass
    npm maintainer advisory
  2. 5.5
    CVE-2026-100547 OpenClaw before 2026.8.1 Authentication Bypass via File URL
    npm maintainer advisory
  3. 6.3
    CVE-2026-100592 OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming
    npm maintainer advisory
  4. 8.8
    CVE-2026-100599 OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome
    npm maintainer advisory
  5. 7.1
    CVE-2026-59965 @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission
    npm
  6. 7.5
    CVE-2026-59960 Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core
    npm
  7. 9.4
    GHSA-h73x-698r-qrvg Multi-Stage Workspace Context Escalation & Sandbox Escape via Bootstrap Gate Bypass and Unbounded Directory Enumeration
    npm unreviewed · maintainers only
    published 2026-09-09
  8. 9.5
    CVE-2026-88062 OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
    npm
    EPSS 1.4% chance of exploitation in 30 days, percentile 73%
  9. 8.2
    GHSA-q57w-g8rw-8595 Workload identity attestation generated before login host validation in Snowflake drivers
    npm unreviewed · maintainers only
  10. 7.4
    GHSA-qc84-pr5g-62fj Improper OCSP response validation in Snowflake drivers
    npm unreviewed · maintainers only
  11. 8.1
    GHSA-x7m8-jrm8-hpvx @eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
    npm
  12. 9.6
    GHSA-6h9g-hcv4-66p6 Import-time RCE in @orval/core combine generator via unescaped schema names in single-quoted TS type literal
    npm unreviewed · maintainers only
  13. 4.8
    CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
    npm maintainer advisory
  14. 6.5
    CVE-2026-100688 Budibase server before 3.45.0 Cross-Tenant Information Disclosure
    npm maintainer advisory
  15. 5.5
    CVE-2026-100687 Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast
    npm maintainer advisory
  16. 8.1
    CVE-2026-100686 Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps
    npm maintainer advisory
  17. 7.7
    CVE-2026-100685 Budibase before 3.45.0 Information Disclosure via Chat Links
    npm maintainer advisory
  18. 8.1
    CVE-2026-100684 Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC
    npm maintainer advisory
  19. 8.0
    CVE-2026-100683 Budibase before 3.45.0 SQL Injection via column-rename DDL
    npm maintainer advisory
  20. 8.8
    CVE-2026-100682 Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink
    npm maintainer advisory
  21. 5.4
    CVE-2026-100681 Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook
    npm maintainer advisory
  22. 8.1
    CVE-2026-100680 Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import
    npm maintainer advisory
  23. 5.9
    CVE-2026-100701 Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion
    npm
  24. 5.9
    CVE-2026-100702 Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays
    npm
  25. 8.3
    CVE-2026-59179 OpenHop: Path Traversal in Flow ID File Operations
    npm
  26. 7.8
    CVE-2026-59176 Functype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import
    npm
  27. 8.8
    CVE-2026-59160 Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run
    npm
  28. 7.5
    CVE-2026-59158 Nuxt Ollama: public runtime configuration discloses the configured cloud API key
    npm
  29. 8.7
    CVE-2026-101895 Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
    npm
  30. 4.6
    CVE-2026-105784 Joplin whiteboard card rendering allows CSS injection into application chrome
    npm maintainer advisory