Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 9.8
    CVE-2026-110644 nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType
    npm
    EPSS 2.7% chance of exploitation in 30 days, percentile 86%
  2. 9.8
    CVE-2026-110634 git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings
    npm
    EPSS 2.3% chance of exploitation in 30 days, percentile 83%
  3. 7.5
    CVE-2026-118641 n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes
    npm maintainer advisory
  4. 7.1
    CVE-2026-118642 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows
    npm maintainer advisory
  5. 8.2
    CVE-2026-118647 n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data
    npm maintainer advisory
  6. 7.1
    CVE-2026-118675 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow
    npm maintainer advisory
  7. 7.1
    CVE-2026-118676 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass
    npm maintainer advisory
  8. 7.7
    CVE-2026-118644 n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance
    npm maintainer advisory
  9. 5.9
    CVE-2026-118677 n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance
    npm maintainer advisory
  10. 7.5
    CVE-2026-118679 n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger
    npm maintainer advisory
  11. 5.4
    CVE-2026-118640 n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass
    npm maintainer advisory
  12. 8.7
    CVE-2026-118645 n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter
    npm maintainer advisory
  13. 8.2
    CVE-2026-118643 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data
    npm maintainer advisory
  14. 6.5
    CVE-2026-118646 n8n before 1.123.85, 2.43.5, and 2.44.1 ReDoS via Read/Write Files Node
    npm maintainer advisory
  15. 8.3
    CVE-2026-118649 n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables
    npm maintainer advisory
  16. 7.3
    CVE-2026-118648 n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy
    npm maintainer advisory
  17. 7.1
    CVE-2026-118678 n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
    npm maintainer advisory
  18. 5.4
    CVE-2026-107371 Missing Verification of auth_time Claim in auth0.js
    npm maintainer advisory
  19. 5.3
    CVE-2026-107370 Improper Request Handling for Active Directory Logins in auth0-lock
    npm maintainer advisory
  20. 6.1
    CVE-2026-107369 Improper Validation of Post-Login Redirect URL in nextjs-auth0
    Next.jsnpm maintainer advisory
  21. 7.5
    CVE-2026-86063 Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
    npm
  22. 8.7
    CVE-2026-84994 Qwik: Crashing any Qwik Server via Resource thenable
    npm
  23. 4.7
    CVE-2026-77361 obsidian-tc symlink path mismatch bypasses read ACL restrictions
    npm
  24. 4.3
    CVE-2026-77362 obsidian-tc bridge tools expose data outside the read ACL
    npm
  25. 5.3
    CVE-2026-109955 Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding
    npm
  26. 3.7
    CVE-2026-107832 fastify vulnerable to header validation bypass via case-sensitive propertyNames
    npm
  27. 8.8
    CVE-2026-114142 toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
    npm
  28. 8.7
    CVE-2026-114141 toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
    npm
  29. 8.7
    CVE-2026-114143 toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
    npm
  30. 7.5
    CVE-2026-114144 toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
    npm