Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 9.0
    CVE-2026-100721 vm2 before 3.12.2 Authorization Bypass via Custom Resolver
    npm
  2. 9.2
    CVE-2026-102829 simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
    npm
  3. 9.8
    CVE-2026-102828 simple-git unsafe-operation guard does not block trailer command configuration
    npm
  4. 8.1
    CVE-2026-102826 simple-git allows command execution through unblocked Git configuration includes
    npm
  5. 8.1
    CVE-2026-102827 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
    npm
  6. 7.1
    CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
    npm
  7. —
    GHSA-29h2-jr22-frmh OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
    npm
  8. 8.6
    CVE-2026-102360 lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory
    npm maintainer advisory
  9. 4.3
    CVE-2026-93363 Payload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route
    npm
  10. 7.4
    CVE-2026-61788 @bytebase/dbhub's read-only mode does not prevent database writes
    npm
  11. 6.1
    CVE-2026-61784 xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
    npm
  12. 7.5
    CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
    npm
  13. 9.3
    CVE-2026-61742 DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
    npm
  14. 8.7
    CVE-2026-56744 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)
    npm
  15. 9.1
    CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route
    npm
  16. —
    GHSA-8x46-p23f-wqr2 Cross-request flag-state leakage in @flags-sdk/flagsmith
    npm unreviewed · maintainers only
  17. 7.5
    CVE-2026-102600 Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
    npm
  18. 8.2
    CVE-2026-101896 Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR)
    npm
  19. 7.6
    CVE-2026-77394 OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
    npm
  20. 6.2
    CVE-2026-107390 music-metadata: MP4 parser allows memory exhaustion via oversized extended atom length
    npm maintainer advisory
  21. 6.2
    CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master
    npm
  22. 6.2
    CVE-2026-107387 music-metadata: Uncontrolled memory allocation in APEv2 parser
    npm
  23. 6.2
    CVE-2026-107388 music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS
    npm
  24. 2.3
    CVE-2026-97711 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
    npm
  25. 6.1
    CVE-2026-109345 DOMPurify before 3.4.16 XSS via IN_PLACE Returned Rawtext Root
    npm
  26. 6.1
    CVE-2026-109344 DOMPurify from 3.4.13 before 3.4.16 DOM XSS via IN_PLACE afterSanitize Hooks
    npm
  27. 4.3
    CVE-2026-61834 scim-patch: Mutation of Inherited Built-in Method Objects
    npm
  28. 10.0
    CVE-2026-59167 SunEditor: Critical XSS vulnerability - sanitizer bypass
    npm
  29. 9.8
    GHSA-w4x4-mpp4-4854 Import-time code execution in @orval/core factory generator via unescaped numeric/boolean enum member
    npm unreviewed · maintainers only
  30. 7.8
    CVE-2026-96889 Librsvg: use-after-free when xml includes have duplicated entities
    Next.jsnpmcrates.io