CLEANSTART-2024-JJ45214 Use after free in Dev Tools in Google Chrome prior to 101

Security vulnerability affects the chromium package. Use after free in Dev Tools in Google Chrome prior to 101...

SUSE CVE-2026-97595

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154subifframe queues received beacon and MAC-command frames onto local-rxbeaconlist / rxmaccmdlist and schedules a process-context worker,...

Malicious Package

Overview epic-webpack-hot-dev-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CLSA-2026-1790756051 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.2-tuxcare.1...

CLSA-2026-1790755864 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.3-tuxcare.2...

MAL-2026-17432 Malicious code in brioche-apl-dev-env (npm)

brioche-apl-dev-env is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, worki...

Malicious code in brioche-apl-dev-env (npm)

brioche-apl-dev-env is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, worki...

PT-2026-102963

Name of the Vulnerable Software and Affected Versions AiSOC versions 9.0.0 through 11.9.9 Description Authentication is not enforced on the response-action API endpoints when AISOC DEV MODE is enabled and AISOC ACTIONS SERVICE TOKEN is empty within the default Docker Compose deployment. This allo...

@angular-builders/custom-esbuild (>=18.0.0-beta.3, <=19.1.0), @angular-builders/custom-webpack (>=18.0.0-beta.3, <=19.0.1) +99 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=7.0.0, <=7.4.3)

webpack-dev-middleware NPM version =7.0.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1020.0.4, =6.0.0, =18.0.0, =1.0.0, =0.20.0-beta-0, =18.0.0-next.1, =18.0.0-next.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 and more Source...

NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath vulnerability discovered by ? in WordPress Npm webpack-dev-middleware versions 7.4.5...

@angular-builders/custom-esbuild (>=18.0.0-beta.3, <=19.1.0), @angular-builders/custom-webpack (>=18.0.0-beta.3, <=19.0.1) +101 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=7.0.0, <=7.4.5)

webpack-dev-middleware NPM version =7.0.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1020.0.4, =6.0.0, =18.0.0, =1.0.0, =0.20.0-beta-0, =18.0.0-next.1, =18.0.0-next.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 and more Source...

@fontoxml/fontoxml-development-tools (>=8.17.0-nightly.20260605232913, <=8.18.0-nightly.20261016232858), @nitro/app (>=11.0.8, <=12.0.0-beta.1) +1 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.3, <=8.1.1)

webpack-dev-middleware NPM version =8.0.3, =8.17.0-nightly.20260605232913, =11.0.8, =7.3.1-canary.202dbfd.0, =7.4.2-canary.dbb8c4b.0 Source cves: CVE-2026-76844 Source advisory: OSV:GHSA-G84C-RXFJ-3J2C...

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...

EUVD-2026-64850

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath...

GHSA-G84C-RXFJ-3J2C webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...

@fontoxml/fontoxml-development-tools (>=8.17.0-nightly.20260605232913, <=8.18.0-nightly.20261016232858), @nitro/app (>=11.0.8, <=12.0.0-beta.1) +1 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.3, <=8.1.1)

webpack-dev-middleware NPM version =8.0.3, =8.17.0-nightly.20260605232913, =11.0.8, =7.3.1-canary.202dbfd.0, =7.4.2-canary.dbb8c4b.0 Source cves: CVE-2026-76844 Source advisory: GHSA-G84C-RXFJ-3J2C...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.2 Release.

Red Hat OpenShift Dev Spaces 3.30.2 has been released. The 3.30.2 release fixes the regression CRW-13015 Get Started / sample cards on the dashboard are empty after upgrade to 3.30. This release provides additional CVE fixes and container dependency updates to Dev Spaces 3.30. Red Hat OpenShift D...

CLEANSTART-2026-YT66630 webpack-dev-server allows users to use webpack with a development server that provides live reloading

Security vulnerability affects the argo-workflows package. webpack-dev-server allows users to use webpack with a development server that provides live reloading...

GO-2026-6535 Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet

Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet...

GO-2026-6517 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

kcp front-proxy does not strip inbound X-Remote- identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp...