Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 6.5
    CVE-2026-106458 Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
    npm
  2. 6.8
    CVE-2026-106457 Backstage: Insufficient audience validation in the Cloudflare Access auth provider
    npm
  3. 4.8
    CVE-2026-106456 Backstage: Inconsistent credential enforcement for overlapping proxy routes
    npm
  4. 7.7
    CVE-2026-106455 Backstage: Improper validation of MkDocs plugin configuration in TechDocs
    npm
  5. 4.1
    CVE-2026-106109 Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
    npm
  6. 8.3
    CVE-2026-106107 Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
    npm
  7. 7.1
    CVE-2026-106106 Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
    npm
  8. 8.4
    CVE-2026-106105 Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
    npm
  9. 8.7
    CVE-2026-106104 Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
    npm
  10. 7.1
    CVE-2026-106103 Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
    npm
  11. 10.0
    CVE-2026-106102 Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
    npm
  12. 3.1
    CVE-2026-106101 Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
    npm
  13. 2.1
    CVE-2026-112945 Vite: Cross origin script execution through Vite custom middleware
    npm
  14. 6.3
    CVE-2026-112947 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
    npm
  15. 6.3
    CVE-2026-112946 Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
    npm
  16. 6.3
    CVE-2026-112943 launch-editor: escapeCmdArgs() omits % escaping on Windows
    npm
  17. 6.3
    CVE-2026-112944 launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
    npm
  18. 7.5
    CVE-2026-112942 launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
    npm
    EPSS 1.7% chance of exploitation in 30 days, percentile 77%
  19. 7.6
    GHSA-h5rh-4jwf-738p Account takeover through MCP password recovery
    npm unreviewed · maintainers only
  20. 7.1
    GHSA-jjm7-864w-gg8q Hidden-field leak in MCP login responses
    npm unreviewed · maintainers only
  21. 8.7
    GHSA-2qw6-cm49-277x Access bypass of Payload Jobs
    npm unreviewed · maintainers only
  22. 6.5
    CVE-2026-114065 Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders
    npm maintainer advisory
  23. 4.7
    CVE-2026-106444 Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates
    npm
  24. 9.8
    CVE-2026-106446 Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)
    npm
  25. 9.2
    CVE-2026-106445 Handlebars: JavaScript Injection via Own Property Check Bypass
    npm
  26. 4.7
    CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
    npm
  27. 4.7
    CVE-2026-114061 SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
    npm
  28. 5.3
    CVE-2026-114062 SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks
    npm maintainer advisory
  29. 7.5
    CVE-2026-114063 SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
    npm maintainer advisory
  30. 6.5
    CVE-2026-105680 Ghost: Authorization Issue Allowed Author Role to Delete any Post
    npmbitnami