Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 8.2
    CVE-2026-110843 n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Authorize Endpoint
    npm maintainer advisory
  2. 7.5
    CVE-2026-110869 Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexes
    npm
  3. 5.3
    CVE-2026-110870 Nodemailer before 10.0.13 Improper Input Validation via Angle-Bracket Address Comments
    npm
  4. 6.5
    CVE-2026-110871 Nodemailer 3.0.0 before 10.0.10 Quadratic DKIM Header Unfolding Denial of Service
    npm
  5. 5.9
    CVE-2026-110872 Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply Parsing
    npm
  6. 5.7
    CVE-2026-105804 Payload: Password hashes use insufficient PBKDF2 iterations
    npm
  7. 8.1
    CVE-2026-110863 Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO Providers
    npm maintainer advisory
  8. 9.1
    CVE-2026-105772 Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId
    npm maintainer advisory
  9. 8.6
    CVE-2026-102521 lib0 `readFromDataView` out-of-bounds read
    npm maintainer advisory
  10. 4.7
    CVE-2026-110866 Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
    npm maintainer advisory
  11. 8.5
    CVE-2026-110868 Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources
    npm maintainer advisory
  12. 7.1
    CVE-2026-110865 Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
    npm maintainer advisory
  13. 8.5
    CVE-2026-110867 Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
    npm maintainer advisory
  14. 5.3
    CVE-2026-111757 Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
    npm maintainer advisory
  15. 5.3
    CVE-2026-118663 @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
    npm
  16. 7.8
    CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix
    npm maintainer advisory
    EPSS 1.0% chance of exploitation in 30 days, percentile 63%
  17. 8.1
    CVE-2026-102422 shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
    npm
  18. 3.7
    CVE-2026-102414 pbkdf2 rehashes long passwords on every iteration, enabling denial of service
    npm
  19. —
    GHSA-4mqq-99j3-3hmv AI SDK Harness session resume can expose host credentials to sandboxed code
    npm unreviewed · maintainers only
  20. 9.1
    CVE-2026-101894 @xhmikosr/decompress: Path traversal via symlink chain
    npm
  21. 7.8
    GHSA-456v-xq2p-r4cj code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
    npm
  22. 8.1
    CVE-2026-109346 better-auth 1.3.8-beta.3 before 1.7.0-rc.3 Device Authorization Phishing via /device
    npm
  23. —
    GHSA-9355-h2pj-8fqj Denial of Service via TypedArray/DataView buffer type-confusion in fromJSON / fromCrossJSON
    npm unreviewed · maintainers only
  24. 8.1
    GHSA-4c7f-ggfh-wm45 Type confusion in seroval-plugins ReadableStream deserialize invokes attacker-influenced methods during fromJSON
    npm unreviewed · maintainers only
  25. 6.5
    GHSA-8q2v-cx68-9v9h Thenable confusion in seroval-plugins AbortSignal deserialize invokes attacker-influenced .then during fromJSON
    npm unreviewed · maintainers only
  26. 3.1
    CVE-2026-109332 Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport
    npm maintainer advisory
  27. 4.3
    CVE-2026-109330 Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer
    npm maintainer advisory
  28. 7.4
    CVE-2026-109331 Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget
    npm maintainer advisory
  29. 7.5
    CVE-2026-100723 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool
    npm
  30. 6.8
    CVE-2026-100722 vm2 before 3.12.2 Host Process Termination via Construct Trap
    npm