Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 8.1
    CVE-2026-107384 MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
    MariaDBnpmbitnami
  2. 7.5
    CVE-2026-107383 MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
    MariaDBnpmbitnami
  3. 5.9
    CVE-2026-107382 MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
    MariaDBnpmbitnami
  4. 8.8
    CVE-2026-107375 JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
    npm
  5. 7.6
    CVE-2026-107303 JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
    npm
  6. 7.5
    CVE-2026-107302 msgpack5: Truncated map32 headers throw an unexpected error
    npm
  7. 6.5
    CVE-2026-107301 msgpack5: Partial options disable prototype protection
    npm
  8. 7.5
    CVE-2026-107300 msgpack5: Many buffered values can exhaust the streaming decoder stack
    npm
  9. 5.9
    CVE-2026-107299 msgpack5: Reserved byte can cause unbounded stream buffering
    npm
  10. 5.3
    CVE-2026-107298 msgpack5: Deeply nested input can exhaust the decoder stack
    npm
  11. 5.9
    CVE-2026-107297 msgpack5: Quadratic parsing in the streaming decoder
    npm
  12. 3.7
    CVE-2026-107296 msgpack5: Decoding negative int64 values mutates the input buffer
    npm
  13. 8.8
    GHSA-f96w-763g-hg7v Import-time RCE in @orval/effect enum generator via raw non-string member emission
    npm unreviewed · maintainers only
  14. 8.7
    CVE-2026-116693 dd-trace: ReDOS in URL query string obfuscation
    npm
  15. 7.4
    CVE-2026-107318 @fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports
    npm maintainer advisory
  16. 6.0
    GHSA-mg7r-jhr9-m745 Improper privilege management in scheduled publishing
    npm unreviewed · maintainers only
  17. 5.8
    GHSA-wvw7-x9pg-w4cc Insufficient session expiration after password changes
    npm unreviewed · maintainers only
  18. 6.0
    GHSA-g6p9-6gm4-cj6m Authorization bypass of client uploads
    npm unreviewed · maintainers only
  19. 5.3
    GHSA-m35c-r5p5-c3w8 Improper Restriction of Excessive Authentication Attempts
    npm unreviewed · maintainers only
  20. 4.8
    GHSA-97w9-jq7h-73pq Improper Neutralization of Formula Elements in a CSV File in plugin-import-export
    npm unreviewed · maintainers only
  21. 5.3
    GHSA-8j2x-hjh9-3ff8 Incorrect authorization for framework collections
    npm unreviewed · maintainers only
  22. 7.6
    GHSA-cqr4-hjg9-833p Improper authentication in MCP when using custom authentication
    npm unreviewed · maintainers only
  23. 6.8
    CVE-2026-107275 @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
    npm maintainer advisory
  24. 8.7
    CVE-2026-63316 SQL Injection in Payload CMS
    npm
  25. 6.5
    CVE-2026-107353 traverse: set() can write to built-in prototypes via an untrusted path
    npm maintainer advisory
  26. 7.7
    CVE-2026-106557 Backstage: Improper input validation in TechDocs Markdown extension configuration
    npm
  27. 5.7
    CVE-2026-106108 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory
    npm
  28. 5.3
    CVE-2026-106563 Backstage: Improper entity validation in deprecated Kubernetes services endpoint
    npm
  29. 4.3
    CVE-2026-106562 Backstage: Incorrect authorization in search engine permission filtering
    npm
  30. 5.0
    CVE-2026-106561 Backstage: Sensitive information disclosure in Kubernetes resource queries
    npm