Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 6.5
    CVE-2026-115923 Backstage catalog rules can be bypassed for URL locations using encoded path segments
    npm
  2. 7.3
    CVE-2026-115418 SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha
    npm maintainer advisory
  3. 7.4
    CVE-2026-118763 @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
    npm
  4. 5.9
    CVE-2026-116689 follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects
    npm
  5. —
    GHSA-m4pr-rgwp-x36r style-dictionary 5.7.0: convertTokenData prototype pollution by descending through an earlier leaf token (fourth bypass of GHSA-vj5c-m527-mpff fixes)
    npm unreviewed · maintainers only
  6. 6.1
    GHSA-2rqm-h6hv-g79v odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
    npm
  7. 9.3
    CVE-2026-124494 SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass
    npm maintainer advisory
  8. 6.1
    CVE-2026-124422 SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder
    npm maintainer advisory
  9. 3.1
    CVE-2026-124425 Parse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save Response
    npm maintainer advisory
  10. 7.1
    CVE-2026-115478 obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
    npm
  11. 7.1
    CVE-2026-115477 obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
    npm
  12. 4.7
    CVE-2026-115754 serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body
    npm
  13. 4.2
    CVE-2026-115752 Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon
    npm
  14. 8.2
    CVE-2026-118664 decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
    npm
  15. 7.5
    CVE-2026-106765 @rog0x/mcp-docker-tools: executes arbitrary code via the handleImageList function
    npm
  16. 7.5
    CVE-2026-106764 @rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function
    npm
  17. 7.5
    CVE-2026-106763 @justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions
    npm
  18. 2.1
    CVE-2026-115897 Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
    npm maintainer advisory
  19. 8.1
    CVE-2026-115419 Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
    pypinpm
  20. 7.5
    CVE-2026-123487 Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regex
    npm maintainer advisory
  21. 4.4
    CVE-2026-106484 MCP roots bypass via extension-rewritten symlink output path
    npm maintainer advisory
  22. 4.7
    GHSA-xfxg-8r4q-wj4v Service-worker initiated fetches bypass chrome-devtools-mcp global URL allowlist/blocklist
    npm unreviewed · maintainers only
  23. 7.5
    CVE-2026-113872 multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
    npm
  24. 7.5
    CVE-2026-111181 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
    npm
  25. 7.4
    CVE-2026-115570 Electron: Mitigation for compromised eMudhra intermediate certificates
    npm
  26. 8.2
    CVE-2026-112085 webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
    npm maintainer advisory
  27. 5.3
    CVE-2026-114348 webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint
    npm maintainer advisory
  28. 7.8
    CVE-2026-116576 systeminformation: Windows command injection in services() through Unicode quotation marks
    npm
  29. 7.5
    CVE-2026-119025 open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows
    npm maintainer advisory
    EPSS 1.4% chance of exploitation in 30 days, percentile 73%
  30. 3.1
    CVE-2026-122301 Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response
    npm maintainer advisory