Skip to content
Fencer Intel

All · npm

Newest first, late arrivals on top. Also a feed.

  1. 3.7
    GHSA-ff5q-5r4v-fw4v Caller headers (Authorization) forwarded to cross-origin redirect targets; blockedHosts bypass with trailing dot
    npm unreviewed · maintainers only
    published 2026-10-20
  2. 8.2
    GHSA-w9x9-j56r-h98r @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
    npm
  3. —
    GHSA-c33x-vcv4-vg3g Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
    crates.ionpm
  4. 7.5
    CVE-2026-62264 PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
    npm
  5. 7.1
    CVE-2026-62374 SD JWT JS: Tampered disclosures silently dropped instead of rejected
    npm
  6. 3.7
    CVE-2026-126204 express-rate-limit skipFailedRequests / skipSuccessfulRequests: with the default MemoryStore, a request from an earlier window is still un-counted from the current window
    npm maintainer advisory
  7. —
    GHSA-fc89-m4rj-8472 seroval-plugins: FormData, Headers and Response decode invokes a sender-chosen registered callable
    npm unreviewed · maintainers only
  8. 3.1
    CVE-2026-126392 Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update
    npm maintainer advisory
  9. 8.2
    GHSA-6rwj-6h6r-xmch seroval-plugins 1.7.x: ReadableStream decode invokes a sender-chosen registered value
    npm unreviewed · maintainers only
  10. 8.2
    GHSA-4mfg-r38w-w8fg mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6
    npm
  11. 7.5
    GHSA-7w82-6f9j-v9jp mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths
    npm
  12. 5.4
    CVE-2026-126365 Astro: XSS via unescaped code for unsupported languages in @astrojs/prism
    npm maintainer advisory
  13. 2.3
    CVE-2026-126363 Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js
    npm
  14. 2.3
    CVE-2026-126362 Astro: Reflected XSS via unescaped slot names in @astrojs/svelte
    npm
  15. 8.4
    CVE-2026-118255 Highcharts Grid: javascript: URL in credits.href runs script on click
    npm
  16. 8.6
    CVE-2026-118254 Highcharts Grid: pagination language options are parsed as HTML
    npm
  17. 8.4
    CVE-2026-118253 Highcharts Dashboards: fullscreen labels are parsed as HTML
    npm
  18. 8.4
    CVE-2026-118252 Highcharts Dashboards: sidebar component labels are parsed as HTML
    npm
  19. 8.4
    CVE-2026-118251 Highcharts: javascript: URL in credits.href runs script on click
    npm
  20. 7.2
    CVE-2026-118250 Highcharts: dotted series.keys paths write to Object.prototype
    npm
  21. 7.2
    CVE-2026-118249 Highcharts: series column construction writes to Object.prototype
    npm
  22. 6.9
    CVE-2026-118247 Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
    npm
  23. 8.4
    CVE-2026-118246 Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
    npm
  24. 8.6
    CVE-2026-118245 Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
    npm
  25. 7.2
    CVE-2026-118244 Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print
    npm
  26. 5.3
    CVE-2026-118243 Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`
    npm
  27. 8.5
    CVE-2026-118242 Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
    npm
  28. 8.5
    CVE-2026-116797 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
    npm
  29. 7.2
    CVE-2026-116796 Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
    npm
  30. —
    GHSA-fvxq-xq4h-rqgm First-party cookies forwarded to Sentry when using the Next.js `tunnelRoute` option
    npm unreviewed · maintainers only