Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 6.0
    CVE-2026-118666 GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
    npm
  2. 8.4
    CVE-2026-114604 GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
    npm
  3. 3.7
    CVE-2026-110861 Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race Condition
    npm
  4. 7.4
    CVE-2026-110864 Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth Proxy
    npm
  5. 9.1
    CVE-2026-114607 better-auth: OAuth state can be used as a Magic Link to sign in as another user
    npm maintainer advisory
  6. 7.5
    CVE-2026-104850 MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
    npm
  7. 8.2
    CVE-2026-111752 Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)
    npm
  8. 5.1
    CVE-2026-111754 Angular: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)
    npm
  9. 8.9
    CVE-2026-114111 Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerability
    npm
  10. 9.3
    CVE-2026-102989 TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
    npm
  11. 6.5
    CVE-2026-94483 Next.js: Server-Side Request Forgery in Image Optimization
    Next.jsnpm
  12. 5.3
    CVE-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
    Next.jsnpm
  13. 4.2
    CVE-2026-94544 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
    Next.jsnpm
  14. 5.3
    CVE-2026-103004 next.js cache leak on warm `use cache` handlers accessing root param
    Next.jsnpm
  15. 5.3
    CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
    Next.jsnpm
  16. 4.8
    CVE-2026-94484 Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
    Next.jsnpm
  17. 5.4
    CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint
    Next.jsnpm
  18. 6.1
    CVE-2026-110851 n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint
    npm maintainer advisory
  19. 6.0
    CVE-2026-110848 n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection Merge
    npm maintainer advisory
  20. 6.3
    CVE-2026-110852 n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution
    npm maintainer advisory
  21. 6.1
    CVE-2026-110841 n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval
    npm maintainer advisory
  22. 7.0
    CVE-2026-110847 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter
    npm maintainer advisory
  23. 7.7
    CVE-2026-110845 n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation
    npm maintainer advisory
  24. 7.1
    CVE-2026-110853 n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON
    npm maintainer advisory
  25. 7.7
    CVE-2026-110842 n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter
    npm maintainer advisory
  26. 7.0
    CVE-2026-110846 n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook
    npm maintainer advisory
  27. 7.2
    CVE-2026-110850 n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters
    npm maintainer advisory
  28. 7.0
    CVE-2026-110840 n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field
    npm maintainer advisory
  29. 7.2
    CVE-2026-110844 n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows
    npm maintainer advisory
  30. 7.2
    CVE-2026-110849 n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview
    npm maintainer advisory