Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 7.3
    CVE-2026-105649 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
    npmbitnami
  2. 4.0
    CVE-2026-105648 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
    npmbitnami
  3. 4.0
    CVE-2026-105647 Ghost: Server-Side Request Forgery in Bookmark Fetching
    npmbitnami
  4. 4.9
    CVE-2026-105646 Ghost: Regular Expression Denial of Service in Content Import
    npmbitnami
  5. 4.9
    CVE-2026-105645 Ghost: Regular Expression Denial of Service in External Media Inliner
    npmbitnami
  6. 6.8
    CVE-2026-105644 Ghost: Stored XSS via SVG Files in Content Imports
    npmbitnami
  7. 7.3
    CVE-2026-105643 Ghost: Stored XSS via Embed Card Previews
    npmbitnami
  8. 8.8
    CVE-2026-105642 Ghost: Remote Code Execution via Bookmark Card Images
    npmbitnami
  9. 6.8
    CVE-2026-111771 Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
    npm
  10. 7.5
    CVE-2026-104891 mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
    npm
  11. 6.0
    CVE-2026-106119 LangChain: MongoDBChatMessageHistory query injection can allow cross-session access
    npm
  12. 7.8
    CVE-2026-12171 auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF
    npm maintainer advisory
  13. 4.2
    CVE-2026-107719 fast-jwt: Verifier cache accepts expired JWTs without iat.
    npm
  14. 10.0
    GHSA-v36f-hqj9-q8rr Import-time RCE in @orval/core enum generator via unescaped non-primitive enum member in stringifyEnumValue
    npm unreviewed · maintainers only
  15. 5.3
    GHSA-5rfr-xx34-2xxv Two remaining quadratic (ReDoS) parsing paths in basic-ftp 6.2.1 — MLSD detection + PASV parser
    npm unreviewed · maintainers only
  16. 7.5
    GHSA-v7hr-4gv3-67h6 Follow-up to GHSA-3j22-8qj3-26mx: incomplete depth-limit fix in serializeAsync
    npm unreviewed · maintainers only
  17. 8.6
    CVE-2026-111767 MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
    npm
  18. 6.5
    CVE-2026-111769 Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
    npm
  19. 8.5
    CVE-2026-104847 ProseMirror: XSS vulnerability in prosemirror-view's paste handling
    npm
  20. 6.9
    CVE-2026-113653 ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
    npm
  21. 3.7
    CVE-2026-113665 ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
    npm
  22. 3.3
    CVE-2026-113651 ApostropheCMS: Path traversal in uploadfs
    npm
  23. 5.3
    CVE-2026-113664 ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
    npm
  24. 5.6
    CVE-2026-113652 ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
    npm
  25. 3.7
    CVE-2026-113657 ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
    npm
  26. 4.3
    CVE-2026-113660 ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
    npm
  27. 5.9
    CVE-2026-113710 ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
    npm
  28. 6.1
    CVE-2026-113659 ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
    npm
  29. 7.5
    CVE-2026-113711 ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
    npm
  30. 5.4
    CVE-2026-113662 ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
    npm