Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-61685 ReactPress has SQL injection via dynamic column names in TypeORM query builders
    npm
  2. 6.9
    CVE-2026-105805 Payload: Sort queries could expose protected field information
    npm
  3. 8.6
    CVE-2026-105806 Payload: Improper access control for MCP API keys
    npm
  4. 9.3
    CVE-2026-105844 Payload: Prototype pollution in Payload Import Export plugin
    npm
  5. 9.8
    CVE-2026-105845 Payload: SQL Injection in SQLite and Postgres
    npm
  6. 6.1
    CVE-2026-105846 Payload: Untrusted redirect URL parameter exploit
    npm
  7. 7.1
    CVE-2026-77426 Unleash: Missing await on permission check + cross-project IDOR in admin API
    npm
  8. 4.3
    CVE-2026-77425 Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
    npm
  9. 5.3
    CVE-2026-76910 Unleash: Clone-feature lets a user copy a feature from a project they cannot read
    npm
  10. 2.1
    CVE-2026-76909 Unleash: CR-approval email renders user-controlled raw HTML
    npm
  11. 7.5
    CVE-2026-62985 request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process
    npm
  12. 6.9
    CVE-2026-63628 mppx: Gas Draining with access list
    npm
  13. 6.9
    CVE-2026-63627 mppx: Gas Draining with padding
    npm
  14. 5.3
    CVE-2026-94545 Satori-generated SVG has improper escaping
    Next.jsnpm
    EPSS 1.1% chance of exploitation in 30 days, percentile 65%
  15. 5.3
    GHSA-r4xh-jqrq-34v2 smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
    npm
  16. 6.2
    CVE-2026-107389 music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort
    npm
  17. 5.3
    CVE-2026-56682 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
    npm
  18. 7.3
    CVE-2026-56681 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
    npm
    EPSS 1.1% chance of exploitation in 30 days, percentile 66%
  19. 5.1
    CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
    npm
  20. 6.2
    GHSA-v7g3-hcgj-f95g ASF parser insufficiently validates object sizes, allowing infinite loop or memory exhaustion
    npm unreviewed · maintainers only
  21. 7.1
    CVE-2026-61647 @roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
    npm
  22. 5.3
    CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
    npm
  23. 6.5
    CVE-2026-58270 Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
    npm
  24. 8.1
    CVE-2026-58269 Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
    npm
  25. 2.1
    CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions
    npm
  26. 6.8
    CVE-2026-58271 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`
    npm
  27. 9.8
    CVE-2026-118690 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
    npm maintainer advisory
  28. 5.7
    CVE-2026-61612 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
    npm
  29. 8.8
    CVE-2026-63116 deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
    npm
  30. 5.3
    GHSA-6g4c-jm42-jc5r Uncaught TypeError in resolveColorMix crashes the parser on any color-mix() nested 3+ levels deep
    npm unreviewed · maintainers only