Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 10.0
    CVE-2026-92953 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
    npm
  2. 6.8
    CVE-2026-92952 vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass
    npm
  3. 9.9
    CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
    npm
  4. 8.6
    CVE-2026-92950 vm2 before 3.11.7 Sandbox Escape via CLI require
    npm
  5. 4.0
    CVE-2026-92949 vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor
    npm
  6. 9.9
    CVE-2026-92948 vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
    npm
  7. 10.0
    CVE-2026-92947 vm2 before 3.11.7 Memory Disclosure via Buffer Pool
    npm
  8. 10.0
    CVE-2026-92946 vm2 before 3.11.7 Remote Code Execution via require.external
    npm
  9. 4.2
    CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching
    npm
  10. 9.8
    CVE-2026-92944 vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector
    npm
  11. 7.5
    CVE-2026-92942 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry
    npm
  12. 10.0
    CVE-2026-92941 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
    npm
  13. 10.0
    CVE-2026-92940 vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent
    npm
  14. 9.9
    CVE-2026-92939 vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine
    npm
  15. 9.9
    CVE-2026-92938 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
    npm
  16. 10.0
    CVE-2026-92937 vm2 3.11.6 Remote Code Execution via Promise call/apply
    npm
    EPSS 1.0% chance of exploitation in 30 days, percentile 64%
  17. 5.8
    CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack
    npm
  18. 9.0
    CVE-2026-92935 vm2 NodeVM Remote Code Execution via Array-Shaped Require
    npm
  19. 9.0
    CVE-2026-92934 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
    npm
  20. 5.8
    CVE-2026-92933 vm2 before 3.11.8 Information Disclosure via util.getCallSites
    npm
  21. 8.7
    CVE-2026-89418 Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)
    npm maintainer advisory
  22. 7.7
    CVE-2026-103757 Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation
    npm maintainer advisory
  23. 5.3
    CVE-2026-90982 @fastify/static vulnerable to route guard bypass via path case-folding
    npm maintainer advisory
  24. 8.8
    CVE-2026-63506 Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site
    npm
  25. 7.0
    CVE-2026-68904 node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion
    npm
  26. 8.1
    CVE-2026-63671 @nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
    npm
  27. 8.3
    GHSA-4356-hm4h-ww9c CORS allowlist bypass in @appium/base-driver
    npm unreviewed · maintainers only
  28. 6.1
    CVE-2026-88976 @platejs/core HTML deserialization can trigger browser behavior during parsing
    npm
  29. 8.1
    CVE-2026-92087 @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth
    npm maintainer advisory
  30. 9.1
    CVE-2026-92395 @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
    npm maintainer advisory