@angular-builders/custom-esbuild (>=18.0.0-beta.3, <=19.1.0), @angular-builders/custom-webpack (>=18.0.0-beta.3, <=19.0.1) +101 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=7.0.0, <=7.4.5)

webpack-dev-middleware NPM version =7.0.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1020.0.4, =6.0.0, =18.0.0, =1.0.0, =0.20.0-beta-0, =18.0.0-next.1, =18.0.0-next.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 and more Source...

@fontoxml/fontoxml-development-tools (>=8.17.0-nightly.20260605232913, <=8.18.0-nightly.20261016232858), @nitro/app (>=11.0.8, <=12.0.0-beta.1) +1 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.3, <=8.1.1)

webpack-dev-middleware NPM version =8.0.3, =8.17.0-nightly.20260605232913, =11.0.8, =7.3.1-canary.202dbfd.0, =7.4.2-canary.dbb8c4b.0 Source cves: CVE-2026-76844 Source advisory: OSV:GHSA-G84C-RXFJ-3J2C...

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...

EUVD-2026-64850

webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath...

GHSA-G84C-RXFJ-3J2C webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...

@fontoxml/fontoxml-development-tools (>=8.17.0-nightly.20260605232913, <=8.18.0-nightly.20261016232858), @nitro/app (>=11.0.8, <=12.0.0-beta.1) +1 more potentially affected by CVE-2026-76844 via webpack-dev-middleware (>=8.0.3, <=8.1.1)

webpack-dev-middleware NPM version =8.0.3, =8.17.0-nightly.20260605232913, =11.0.8, =7.3.1-canary.202dbfd.0, =7.4.2-canary.dbb8c4b.0 Source cves: CVE-2026-76844 Source advisory: GHSA-G84C-RXFJ-3J2C...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.2 Release.

Red Hat OpenShift Dev Spaces 3.30.2 has been released. The 3.30.2 release fixes the regression CRW-13015 Get Started / sample cards on the dashboard are empty after upgrade to 3.30. This release provides additional CVE fixes and container dependency updates to Dev Spaces 3.30. Red Hat OpenShift D...

CLEANSTART-2026-YT66630 webpack-dev-server allows users to use webpack with a development server that provides live reloading

Security vulnerability affects the argo-workflows package. webpack-dev-server allows users to use webpack with a development server that provides live reloading...

GO-2026-6535 Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet

Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet...

GO-2026-6517 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp

kcp front-proxy does not strip inbound X-Remote- identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp...

CLSA-2026-1790604947 TuxCare security update for webpack-dev-server (4 CVEs)

TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 4.9.3-tuxcare.1...

CLSA-2026-1790604916 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.4-tuxcare.1...

CLSA-2026-1790520250 TuxCare security update for webpack-dev-middleware (1 CVE)

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.0.1-tuxcare.1...

PT-2026-107633

TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 3.0.1-tuxcare.1...

@htyf-mp/cli (>=0.6.0, <=0.7.6), @htyf-mp/taro-plugin-platform (>=0.6.0, <=0.7.5) +1 more potentially affected by CVE-2026-97724 via react-native-worklets (0.12.1)

react-native-worklets NPM version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on react-native-worklets and may be impacted: - @htyf-mp/cli =0.6.0, =0.6.0, =0.1.5, =0.1.11 Source cves: CVE-2026-97724 Source advisory: MEND:CVE-2026-97724...

Linux Distros Unpatched Vulnerability : CVE-2026-97992

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and...

CVE-2026-97994: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

PT-2026-98751

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds array read occurs in the base assign reply queues function within the mpt3sas SCSI driver. This happens because the dev to node function can return NUMA NO NODE -1 on...

PT-2026-98828

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the High-availability Seamless Redundancy HSR implementation where the hsr dev finalize function can fail after a lower-device RX handler has been registered. Because ...

CVE-2026-97182

A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper...