Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 4.3
    CVE-2026-106495 Backstage: Improper access control in backend action invocation
    npm
  2. 8.6
    CVE-2026-118660 Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
    npm
  3. 8.6
    CVE-2026-114125 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
    npm
  4. 8.7
    CVE-2026-114126 Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story files
    npm
  5. —
    GHSA-m8p5-r7qv-cx4c Full-read SSRF in the default `/_image` endpoint via the same Host header
    npm unreviewed · maintainers only
  6. 6.5
    CVE-2026-114128 Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
    npm
  7. 2.3
    CVE-2026-114127 Astro: Arbitrary CSS injection in Astro View Transitions
    npm
  8. 9.9
    CVE-2026-77366 obsidian-tc tokens can access arbitrary configured vaults
    npm
  9. 6.5
    CVE-2026-77364 obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets
    npm
  10. 8.8
    CVE-2026-77363 obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access
    npm
  11. 6.1
    CVE-2026-116804 DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content
    npm
  12. 6.1
    CVE-2026-116803 DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees
    npm
  13. 6.1
    CVE-2026-116802 DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode
    npm
  14. 8.6
    CVE-2026-92682 @neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier
    npm maintainer advisory
  15. 9.3
    CVE-2026-92681 @neo4j/graphql: schema-level and type-level @authentication not enforced on top-level @cypher fields
    npm maintainer advisory
  16. 4.3
    CVE-2026-116801 Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query
    npm maintainer advisory
  17. 6.3
    CVE-2026-111997 ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
    npm
  18. 7.5
    GHSA-46qc-v7pw-4j7j Unbounded validation-error enumeration in Elysia allows unauthenticated Denial of Service (memory exhaustion)
    npm unreviewed · maintainers only
  19. 5.3
    GHSA-4cm8-f57v-mqm6 Prettier quadratic CPU consumption when formatting GFM Markdown tables
    npm unreviewed · maintainers only
  20. 7.3
    GHSA-mp7h-j8pr-w35w Prototype Pollution via the `locale` argument of `mergeLocaleMessage`, `mergeDateTimeFormat` and `mergeNumberFormat`
    npm unreviewed · maintainers only
  21. 2.1
    CVE-2026-118256 Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
    npm
  22. 7.2
    CVE-2026-118257 Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
    npm
  23. 9.3
    CVE-2026-108261 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
    npm
  24. 7.6
    CVE-2026-108260 @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
    npm
  25. 8.2
    CVE-2026-108259 Tina: Code injection via unescaped Git branch name in generated client source
    npm
  26. 6.5
    CVE-2026-108096 Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category
    npm maintainer advisory
  27. 6.5
    CVE-2026-118661 Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
    npm
  28. 6.1
    CVE-2026-107718 AdonisJS: Unencoded route parameters can produce open redirects
    npm
  29. 5.5
    GHSA-h6j4-qpp7-q28p Improper link resolution in asset bundling output handling in aws-cdk-lib
    npm unreviewed · maintainers only
  30. 7.4
    CVE-2026-107385 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
    MariaDBnpmbitnami