Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 6.1
    CVE-2026-113787 odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values
    npm
  2. 6.9
    CVE-2026-118662 Vite: `server.fs.deny` bypassed with queries
    npm
  3. 5.3
    CVE-2026-116583 Seroval: Code injection through a typed array's own constructor property
    npm
  4. 4.7
    CVE-2026-116582 Seroval: Script injection through RegExp sources in serialized output
    npm
  5. 7.5
    CVE-2026-116581 Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)
    npm
  6. 7.5
    CVE-2026-116584 Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
    npm
  7. 7.3
    CVE-2026-116580 Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
    npm
  8. 5.3
    CVE-2026-121965 Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key
    npm maintainer advisory
  9. 8.8
    CVE-2026-115895 Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
    npm
  10. 9.1
    CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch
    npm maintainer advisory
  11. 6.5
    GHSA-3gg4-m4mq-vcxc EncryptedAssertion decryption accepts RSA-1.5 key transport and TripleDES-CBC
    npm unreviewed · maintainers only
  12. 6.5
    GHSA-63ch-w8pw-4mf2 Signature wrapping bypass for LogoutRequest and AuthnRequest
    npm unreviewed · maintainers only
  13. 6.8
    GHSA-fq9x-v53h-7w5p samlify: CVE-2026-46490 fix escapes attribute values but leaves attribute metadata (name/nameFormat) unescaped
    npm unreviewed · maintainers only
  14. 8.2
    GHSA-963m-r92r-qm7c XML comment node-splitting in SP assertion extraction allows SAML impersonation and privilege escalation
    npm unreviewed · maintainers only
  15. 7.5
    GHSA-3427-gh8x-vv2c Unbounded DEFLATE Inflation in SAML Redirect Binding Parser Leads to Remote Unauthenticated Denial of Service
    npm unreviewed · maintainers only
  16. 8.2
    GHSA-wj54-2vfp-35f2 Missing InResponseTo validation enables SAMLResponse replay and IdP-initiated SSO bypass
    npm unreviewed · maintainers only
  17. —
    GHSA-wr2x-fh6q-q243 Redirect and SimpleSign signatures are not bound to the parsed message
    npm unreviewed · maintainers only
  18. 8.2
    GHSA-wxh7-j2vx-w63f Missing AudienceRestriction enforcement enables cross-SP account takeover
    npm unreviewed · maintainers only
  19. 9.1
    GHSA-w8r9-gp23-wcxp samlify accepts an attacker-controlled signing certificate when IdP metadata uses RSAKeyValue
    npm unreviewed · maintainers only
  20. 3.1
    CVE-2026-121413 Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession
    npm maintainer advisory
  21. 3.7
    CVE-2026-110725 fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
    npm
  22. 4.8
    CVE-2026-110180 fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
    npm
  23. 3.7
    CVE-2026-110095 fast-uri vulnerable to improper path equivalence in relative reference normalization
    npm
  24. 6.1
    CVE-2026-110306 fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
    npm
  25. 3.7
    CVE-2026-121415 Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key
    npm maintainer advisory
  26. 3.3
    CVE-2026-116673 systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net
    npm
  27. 6.5
    CVE-2026-116674 systeminformation: Prototype pollution in `networkStats()` via the interface name
    npm
  28. 6.5
    CVE-2026-121426 Nodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
    npm
  29. 6.5
    CVE-2026-121425 Nodemailer 3.0.0 before 10.1.4 Recipient Injection via addressparser Group Parsing
    npm
  30. 6.5
    CVE-2026-121424 Nodemailer 3.0.0 before 10.1.4 Address Parsing Bypass via Nested Comments
    npm