Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 4.2
    CVE-2026-110008 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
    npm maintainer advisory
  2. 7.5
    CVE-2026-115887 graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
    npm
  3. 5.9
    CVE-2026-121414 Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update
    npm maintainer advisory
  4. 7.5
    GHSA-f2hq-32vh-53cc postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
    npm
  5. —
    GHSA-fv63-qcqv-fg6m MSSQL jsonBuildObject helper concatenates user-supplied object keys as raw SQL via sql.raw
    npm unreviewed · maintainers only
  6. 3.7
    CVE-2026-118258 i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
    npm
  7. 3.1
    CVE-2026-120310 Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response
    npm maintainer advisory
  8. 7.5
    CVE-2026-116795 RE2JS: Quadratic-time denial of service in re2js lookbehind matching
    npm
  9. 3.3
    GHSA-h4fr-cmh5-qr62 Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
    npmcrates.io
  10. 3.3
    CVE-2026-115569 Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
    npmcrates.io
  11. 7.3
    CVE-2026-120314 Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations
    npm maintainer advisory
  12. 7.5
    CVE-2026-120313 Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath
    npm maintainer advisory
  13. 8.8
    CVE-2026-120312 Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name
    npm maintainer advisory
  14. 8.8
    CVE-2026-120311 Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID
    npm maintainer advisory
  15. 6.8
    CVE-2026-110024 @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults
    npm maintainer advisory
  16. 3.1
    CVE-2026-76894 CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)
    npm
  17. 6.3
    CVE-2026-114132 Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
    npm
  18. 3.7
    CVE-2026-120309 Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam
    npm maintainer advisory
  19. 5.4
    CVE-2026-114133 Nuxt server islands render `useHeadSafe` input without sanitisation
    npm
  20. 5.9
    CVE-2026-109461 Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
    npm
  21. 2.3
    CVE-2026-114130 Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
    npm
  22. 6.5
    CVE-2026-114131 Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
    npm
  23. 4.2
    CVE-2026-128348 ExcelJS through 4.4.0 Formula Injection via Table Totals Row Column Names
    npm maintainer advisory
  24. 7.5
    CVE-2026-128346 ExcelJS through 4.4.0 Resource Exhaustion via Streaming WorkbookReader Temporary Files
    npm maintainer advisory
  25. 7.5
    CVE-2026-128343 ExcelJS through 4.4.0 Denial of Service via Oversized Row Number
    npm maintainer advisory
  26. 7.5
    CVE-2026-128342 ExcelJS through 4.4.0 Denial of Service via Oversized Worksheet sheetId
    npm maintainer advisory
  27. 7.0
    CVE-2026-128337 ExcelJS through 4.4.0 Prototype Pollution via x14 Conditional Formatting Rule ID
    npm maintainer advisory
  28. 5.3
    CVE-2026-128345 ExcelJS through 4.4.0 ReDoS via slideFormula Shared Formula Translation
    npm maintainer advisory
  29. 7.5
    CVE-2026-128347 ExcelJS through 4.4.0 Arbitrary File Read via WorkbookWriter addImage Filename
    npm maintainer advisory
  30. 7.5
    CVE-2026-128340 ExcelJS through 4.4.0 Memory Exhaustion via Oversized Defined Name Range
    npm maintainer advisory