Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 8.5
    CVE-2026-59973 mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi
    npm
  2. 7.3
    CVE-2026-119282 Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle
    npm
  3. 7.3
    CVE-2026-104859 Nx: OS command injection in the @nx/docker release pipeline
    npm
  4. 8.5
    GHSA-w2vw-w76x-qr89 Nx: OS command injection via git revisions and remote refs
    npm
  5. 8.5
    CVE-2026-104854 Nx daemon and plugin worker sockets are accessible to other local users
    npm
  6. 5.8
    CVE-2026-104853 Nx: Path traversal in nx migrate package-migrations extraction
    npm
  7. 7.8
    CVE-2026-89066 OS command injection in the task synthesis component in projen
    npm maintainer advisory
  8. 7.1
    CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen
    npm maintainer advisory
  9. 7.5
    CVE-2026-100700 nodemailer before 10.0.6 Denial of Service via addressparser
    npm
  10. 7.5
    CVE-2026-90776 Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
    npm
  11. 5.9
    CVE-2026-114104 adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass
    npm
  12. 7.1
    GHSA-679w-jf3m-wh39 Local Privilege Escalation via SUID/SGID preservation during archive extraction
    npm unreviewed · maintainers only
  13. 6.2
    CVE-2026-114105 Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits
    npm maintainer advisory
  14. 5.3
    CVE-2026-114103 adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()
    npm
  15. 7.5
    CVE-2026-114102 adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
    npm
  16. 7.5
    CVE-2026-92000 adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
    npm
  17. 7.1
    CVE-2026-102282 adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
    npm
  18. 7.5
    CVE-2026-77301 adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
    npm
  19. 7.5
    CVE-2026-87776 compression vulnerable to Denial of Service via memory leak on premature response close
    npm
  20. 5.9
    CVE-2026-87123 hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping
    npm maintainer advisory
  21. 5.3
    CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields
    npm
  22. 7.5
    CVE-2026-87908 multiparty vulnerable to Denial of Service via unbounded part-header accumulation
    npm maintainer advisory
  23. 5.4
    CVE-2026-100563 OpenClaw before 2026.8.1 CSV Formula Injection via Session Labels
    npm maintainer advisory
  24. 6.3
    CVE-2026-100591 OpenClaw before 2026.7.1 Authentication Bypass via Active Memory
    npm maintainer advisory
  25. 5.3
    CVE-2026-100571 OpenClaw before 2026.8.1 SMS Webhook Rate Limit Bypass
    npm maintainer advisory
  26. 5.3
    CVE-2026-100526 Vulnerability in discord
    npm maintainer advisory
  27. 8.8
    CVE-2026-100596 OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration
    npm maintainer advisory
  28. 8.8
    CVE-2026-100552 OpenClaw before 2026.8.1 Policy Bypass via Native Tools
    npm maintainer advisory
  29. 3.1
    CVE-2026-100537 OpenClaw before 2026.8.1 Authentication Bypass via Active Memory
    npm maintainer advisory
  30. 6.5
    CVE-2026-100538 OpenClaw before 2026.8.1 Local File Read via Outbound Attachments
    npm maintainer advisory