ROOT-APP-NPM-CVE-2026-14631 CVE-2026-14631 in webpack-dev-server - Patched by Root

Root has patched CVE-2026-14631 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

UBUNTU-CVE-2026-63495

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

dev-tools-eagle (>=0.9.0, <=0.9.4) potentially affected by CVE-2026-55253 via langgraph-store-mongodb (0.1.1)

langgraph-store-mongodb PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-store-mongodb and may be impacted: - dev-tools-eagle =0.9.0, =0.9.4 Source cves: CVE-2026-55253 Source advisory: GHSA-533J-2V4Q-MW5H...

dev-tools-eagle (>=0.9.0, <=0.9.4) potentially affected by CVE-2026-55253 via langgraph-store-mongodb (0.1.1)

langgraph-store-mongodb PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-store-mongodb and may be impacted: - dev-tools-eagle =0.9.0, =0.9.4 Source cves: CVE-2026-55253 Source advisory: OSV:GHSA-533J-2V4Q-MW5H...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

webpack_devserver 5.2.5 Cross Site Request Forgery

webpackdevserver versions 5.2.5 and below suffer from a cross site request forgery vulnerability. Exploit Title: webpackdevserver 5.2.5 - Csrf Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/webpack/webpack-dev-server Software Link:...

CVE-2026-63123

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...

GHSA-RGR9-R7MJ-MF6X Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...

CVE-2026-63123

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

CVE-2026-63123 Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

EUVD-2026-62971

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

CVE-2026-63123 Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

Malicious Package

Overview mcp-dev-toolkit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview dev-env-check is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ranux-dev is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview reqcrypt-dev is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in mcp-dev-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea6d82bd4d62a015c59af54ac277d0381c43203b3475ef1137e57893e67126c Package [email protected] contains multiple files whose behavior matches operational malware rather than a developer toolkit. index.js collects...

MAL-2026-14295 Malicious code in mcp-dev-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea6d82bd4d62a015c59af54ac277d0381c43203b3475ef1137e57893e67126c Package [email protected] contains multiple files whose behavior matches operational malware rather than a developer toolkit. index.js collects...

Malicious code in reqcrypt-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb6f64adb9e9635c1060d7c40db6006cad5446b87dcd7b20ceeb8ee7c6980f8 The package presents itself as a requests-style HTTP client but its response processor inspects every JSON response for the magic keys payloaddd,...