CLSA-2026-1790944348 TuxCare security update for webpack-dev-server (2 CVEs)

TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.9.3-tuxcare.2...

Malicious Package

Overview brioche-apl-dev-env is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @smart-dev-wa/baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Linux Distros Unpatched Vulnerability : CVE-2026-94486

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protoco...

PT-2026-104377

Name of the Vulnerable Software and Affected Versions Next.js versions 16.0.0 through 16.3.7 Description The next dev development server exposes a Model Context Protocol endpoint that does not reliably restrict cross-site requests. This allows a malicious website visited by a developer to access...

PT-2026-104378

Name of the Vulnerable Software and Affected Versions Next.js versions 16.0.0 through 16.3.7 Description The development server in this React framework for building full-stack web applications exposes a Model Context Protocol endpoint that does not reliably restrict cross-site requests. This allo...

CVE-2026-94486: Origin Validation Error

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

Linux Distros Unpatched Vulnerability : CVE-2026-94485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protoco...

CVE-2026-94485: Origin Validation Error

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

MAL-2026-17442 Malicious code in @smart-dev-wa/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

GO-2026-6560 Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet

Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenantid filter in github.com/hatchet-dev/hatchet...

GO-2026-6565 SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in github.com/hatchet-dev/hatchet

SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in github.com/hatchet-dev/hatchet...

CLSA-2026-1790884229 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.0-tuxcare.4...

CLSA-2026-1790876768 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 8.1.1-tuxcare.1...

edc (>=0.3.14, <=0.3.16), thenewboston-ml-dev (0.2.3) potentially affected by CVE-2026-15307 via django (3.1.8)

django PYPI version 3.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - edc =0.3.14, =0.3.16 - thenewboston-ml-dev 0.2.3 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...

PHP-8.1.0-dev-Backdoor

PHP 8.1.0-dev User-Agentt Backdoor Remote Code Execution RCE Severity: Critical CVSS Equivalent: 10.0 Vulnerability Type: Supply Chain Backdoor / Remote Code Execution RCE Affected Software: PHP 8.1.0-dev Development Build Only Attack Vector: Remote Unauthenticated Authentication Required: No Use...

CLSA-2026-1790866099 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.4-tuxcare.2...

CLSA-2026-1790866070 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 6.1.3-tuxcare.1...

CLSA-2026-1790863106 TuxCare security update for webpack-dev-server (2 CVEs)

TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 5.2.5-tuxcare.1...

CLEANSTART-2024-DB58731 Insufficient data validation in Dev Tools in Google Chrome prior to 101

Security vulnerability affects the chromium package. Insufficient data validation in Dev Tools in Google Chrome prior to 101...