Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 7.4
    CVE-2026-109829 undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
    npm
  2. 7.4
    CVE-2026-109383 undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
    npm
  3. 7.5
    CVE-2026-87018 undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
    npm
  4. 5.9
    CVE-2026-109932 undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
    npm
  5. 5.9
    CVE-2026-87029 undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
    npm
  6. 7.5
    CVE-2026-111768 Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
    npm
  7. 7.7
    CVE-2026-111770 Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
    npm
  8. 7.5
    GHSA-f897-62hf-6gxq MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
    npm
  9. 3.1
    CVE-2026-119125 Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields
    npm maintainer advisory
  10. 9.5
    GHSA-59pf-q495-3c99 Unauthenticated Remote Code Execution in React Server Components
    npm unreviewed · maintainers only
  11. 9.1
    CVE-2026-110862 Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic Link
    npm
  12. 5.3
    CVE-2026-110816 qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string
    npm
  13. 3.1
    CVE-2026-115730 i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl
    npm
  14. 3.1
    CVE-2026-119126 Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys
    npm maintainer advisory
  15. 4.3
    CVE-2026-112952 ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
    npm
  16. 4.3
    CVE-2026-112957 ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
    npm
  17. 5.4
    CVE-2026-112951 ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
    npm
  18. 5.4
    CVE-2026-112958 ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
    npm
  19. 5.3
    CVE-2026-112954 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
    npm
  20. 3.1
    CVE-2026-113648 ApostropheCMS: Missing Authentication in `cleanExport` Route
    npm
  21. 5.3
    CVE-2026-113650 ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
    npm
  22. 6.0
    CVE-2026-112953 ApostropheCMS: Exposure of Sensitive Information via predictable export filenames
    npm
  23. 6.5
    CVE-2026-113649 ApostropheCMS: Import API bypasses publication roles for protected content
    npm
  24. 6.5
    CVE-2026-112956 ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content
    npm
  25. 6.5
    CVE-2026-112955 ApostropheCMS: Import archives can exhaust server storage and deny service
    npm
  26. 8.2
    CVE-2026-94482 Next.js: Denial of Service in App Router using Server Actions
    Next.jsnpm
  27. 9.5
    GHSA-673q-mjm6-r5xr Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
    Next.jsnpm
  28. 9.5
    CVE-2026-126187 React: Unauthenticated Remote Code Execution in React Server Components
    Reactnpm
    EPSS 1.8% chance of exploitation in 30 days, percentile 78%
  29. 8.2
    GHSA-h3gv-c5rc-p453 Denial of Service in Server Functions
    Reactnpm unreviewed · maintainers only
  30. 7.5
    CVE-2026-109855 undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
    npm