Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 6.5
    CVE-2026-55369 Waline login accepts a non-string email as a match-all MongoDB query
    npm
  2. 7.5
    GHSA-3pfx-gxff-vg76 Unhandled rejection from a rejected-Promise node in fromJSON can terminate Node.js
    npm unreviewed · maintainers only
  3. 7.5
    GHSA-j2wm-6qr2-34h2 @hapi/wreck crashes the process when a redirect has an invalid Location header
    npm unreviewed · maintainers only
  4. 7.7
    GHSA-w34w-96hf-98hj Code Injection in Generated Server Manifests via Unescaped Route Paths in `@angular/build`
    npm unreviewed · maintainers only
  5. 2.1
    GHSA-jp2q-rh7r-4vjf Stored Cross-Site Scripting (XSS) in Prerendered Redirect Pages in `@angular/build`
    npm unreviewed · maintainers only
  6. 7.5
    CVE-2026-118772 joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
    npm
  7. 7.5
    CVE-2026-119202 @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
    npm
  8. 3.7
    CVE-2026-126390 n8n before 1.123.89 NocoDB Node API Token Leak via Attachment Download
    npm maintainer advisory
  9. 3.7
    CVE-2026-126388 n8n before 2.46.1 Credential Leak via Cross-Origin Redirects in Nodes
    npm maintainer advisory
  10. 6.3
    CVE-2026-126381 n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter Key
    npm maintainer advisory
  11. 5.4
    CVE-2026-126382 n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset
    npm maintainer advisory
  12. 4.7
    CVE-2026-126386 n8n before 1.123.89 Open Redirect via MCP OAuth Dynamic Client Registration
    npm maintainer advisory
  13. 7.7
    CVE-2026-126385 n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback
    npm maintainer advisory
  14. 8.2
    CVE-2026-126383 n8n before 1.123.89 NoSQL Injection via MongoDB Node Update Key
    npm maintainer advisory
  15. 5.4
    CVE-2026-126389 n8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded Chat
    npm maintainer advisory
  16. 5.3
    CVE-2026-126387 n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool
    npm maintainer advisory
  17. 7.5
    CVE-2026-126391 n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape
    npm maintainer advisory
  18. 7.5
    CVE-2026-126384 n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Node
    npm maintainer advisory
  19. 8.8
    CVE-2026-119408 n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes
    npm maintainer advisory
  20. 6.9
    CVE-2026-118764 minimatch: potential denial of service via globparts amplification
    npm
  21. 6.3
    CVE-2026-118773 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
    npm
  22. 7.0
    GHSA-q7hv-gh62-p89c fallow's hooks install interpolates the remote default branch name unvalidated into the generated pre-commit hook, so a crafted branch name executes attacker commands at commit time
    npm unreviewed · maintainers only
  23. 2.5
    GHSA-5h8g-6c9w-67vw A base commit could make Git read a repository config from inside the audit base snapshot
    npm unreviewed · maintainers only
  24. 8.6
    GHSA-mxfr-qhmh-pcx4 Prototype pollution in set-cookie-parser via Set-Cookie name/value attribute override
    npm unreviewed · maintainers only
  25. 4.3
    GHSA-x5w7-48pf-h23p WebSocket upgrades are accepted without an Origin check
    npm unreviewed · maintainers only
  26. 8.5
    CVE-2026-116675 TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
    npmnugetpackagist
  27. 6.5
    GHSA-jx6v-jmqp-x365 Windows drive-relative symlink target bypass in @appium/support ZIP extraction
    npm unreviewed · maintainers only
  28. 6.5
    GHSA-hm39-rvcc-qph6 Symlink chain based Zip Slip in @appium/support ZIP extraction
    npm unreviewed · maintainers only
  29. 9.1
    CVE-2026-46350 dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS
    npm
  30. 3.7
    CVE-2026-117499 @fastify/session vulnerable to session revocation bypass via a logout race condition
    npm maintainer advisory