Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 7.5
    CVE-2026-128341 ExcelJS through 4.4.0 Denial of Service via Oversized Data Validation sqref
    npm maintainer advisory
  2. 7.5
    CVE-2026-128338 ExcelJS through 4.4.0 Memory Exhaustion via Unbounded Worksheet Column Range
    npm maintainer advisory
  3. 7.5
    CVE-2026-128339 ExcelJS through 4.4.0 Memory Exhaustion via Oversized Merged Cell Range
    npm maintainer advisory
  4. 4.8
    CVE-2026-128336 ExcelJS through 4.4.0 Prototype Pollution via __proto__ Defined Name
    npm maintainer advisory
  5. 6.5
    CVE-2026-112948 Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
    npm
  6. 4.7
    CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration
    npm
  7. 5.9
    CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
    npm
  8. 5.9
    CVE-2026-111753 Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
    npm
  9. 6.1
    CVE-2026-120988 XSS via legend.contents.template: tag split across series ids bypasses sanitize
    npm maintainer advisory
  10. 7.5
    CVE-2026-111758 markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)
    npm
  11. 3.7
    CVE-2026-111766 markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled
    npm
  12. 6.8
    CVE-2026-115729 @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass
    npm maintainer advisory
  13. 7.5
    CVE-2026-118659 @happy-dom/server-renderer: ServerRendererServer Target-Origin Bypass SSRF / Open Proxy
    npm maintainer advisory
  14. 3.7
    CVE-2026-119571 Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID
    npm maintainer advisory
  15. 4.2
    CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links
    npm
  16. 5.1
    GHSA-gh4w-rw27-p87x ReDoS in argparse's `int` type conversion (`ArgumentParser.parse_args`) when `parse_args` receives untrusted argv input
    npm unreviewed · maintainers only
  17. 5.5
    GHSA-22mq-c535-7vv9 Out-of-package denial-of-service for CommonJS Electron apps packaged with ASAR
    npm unreviewed · maintainers only
  18. 3.1
    CVE-2026-113797 Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
    npm
  19. 5.4
    CVE-2026-113798 Electron: Pointer lock permission requests can be attributed to the wrong frame
    npm
  20. 3.9
    CVE-2026-114122 Electron: Frame subscription trusts GPU-supplied frame geometry
    npm
  21. 3.9
    CVE-2026-114124 Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
    npm
  22. 5.4
    CVE-2026-114121 Electron: openExternal permission requests can be attributed to the wrong origin
    npm
  23. 5.4
    CVE-2026-113800 Electron: HID and USB permission checks can be attributed to the wrong origin
    npm
  24. 5.3
    CVE-2026-119569 Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service
    npm maintainer advisory
  25. 8.7
    CVE-2026-104150 AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
    npm
  26. 6.9
    CVE-2026-102527 Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
    npm
  27. 3.1
    CVE-2026-119570 Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses
    npm maintainer advisory
  28. 7.5
    CVE-2026-109869 undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
    npm
  29. 5.9
    CVE-2026-109924 undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
    npm
  30. 5.9
    CVE-2026-109841 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
    npm