Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 6.9
    CVE-2026-101904 Axios: Header Injection via Inherited headers After Minimal Interceptor
    npm
  2. 6.9
    CVE-2026-101900 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
    npm
  3. 7.6
    CVE-2026-101905 Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
    npm
  4. 6.9
    CVE-2026-101899 Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
    npm
  5. 7.0
    CVE-2026-101907 Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
    npm
  6. 6.9
    CVE-2026-101908 Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
    npm
  7. 6.9
    CVE-2026-101902 Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
    npm
  8. 8.2
    CVE-2026-101903 Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
    npm
  9. 8.2
    CVE-2026-101906 Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
    npm
  10. 8.3
    CVE-2026-101909 Axios: Prototype Pollution Gadget in axios toFormData Options
    npm
  11. 7.0
    CVE-2026-101898 Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
    npm
  12. 8.2
    CVE-2026-101901 Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
    npm
  13. 4.0
    CVE-2026-103260 n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node
    npm maintainer advisory
  14. 6.8
    CVE-2026-103258 n8n before 2.39.6 and 2.40.x before 2.40.1 Filter Bypass via Parameter Interpolation
    npm maintainer advisory
  15. 7.6
    CVE-2026-103249 n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
    npm maintainer advisory
  16. 5.3
    CVE-2026-103245 n8n before 1.123.80, 2.39.6, and 2.40.1 Missing Webhook Signature Verification
    npm maintainer advisory
  17. 7.1
    CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook
    npm maintainer advisory
  18. 7.6
    CVE-2026-103259 n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials
    npm maintainer advisory
  19. 7.7
    CVE-2026-103252 n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
    npm maintainer advisory
  20. 8.1
    CVE-2026-103250 n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
    npm maintainer advisory
  21. 7.7
    CVE-2026-103246 n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
    npm maintainer advisory
  22. 6.3
    CVE-2026-103254 n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
    npm maintainer advisory
  23. 9.0
    CVE-2026-103248 n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
    npm maintainer advisory
  24. 8.5
    CVE-2026-103247 n8n before 1.123.80 Credential Tampering via Duplicate Node IDs
    npm maintainer advisory
  25. 8.7
    CVE-2026-103253 n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table
    npm maintainer advisory
  26. 7.1
    CVE-2026-103251 n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
    npm maintainer advisory
  27. 3.1
    CVE-2026-116687 CKEditor: Cross-site scripting (XSS) in the engine package
    npm
  28. 8.1
    CVE-2026-116688 CKEditor: Cross-site scripting (XSS) in the engine package
    npm
  29. 5.9
    CVE-2026-92081 fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses
    npm
  30. 9.8
    CVE-2026-61560 @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
    npm
    EPSS 2.9% chance of exploitation in 30 days, percentile 87%