CLSA-2026-1787837620 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.15.2-tuxcare.3...

CLSA-2026-1787837465 TuxCare security update for webpack-dev-server (3 CVEs)

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.11.1-tuxcare.4...

CVE-2026-76844

A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one...

CLSA-2026-1787828309 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.7.3-tuxcare.6...

CLSA-2026-1787823957 TuxCare security update for webpack-dev-server (1 CVE)

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.11.1-tuxcare.3...

CLSA-2026-1787821986 TuxCare security update for webpack-dev-server (3 CVEs)

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.11.5-tuxcare.4...

PT-2026-82837

Name of the Vulnerable Software and Affected Versions WPMU DEV Dashboard versions prior to 5.0.2 Description An authentication bypass exists in the Hub Single Sign-On SSO flow, potentially affecting an estimated 350,000 WordPress sites. The issue stems from HMAC canonicalization confusion—a...

PT-2026-86548

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.7.3-tuxcare.6...

PT-2026-86552

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.11.1-tuxcare.4...

PT-2026-86547

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.11.1-tuxcare.3...

VulnCheck KEV: CVE-2026-76581

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated wdpssostep1 and wdpssostep2 AJAX actions, where step 1 signs and disclose...

PT-2026-86553

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.15.2-tuxcare.3...

Linux Distros Unpatched Vulnerability : CVE-2026-76844

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at...

PT-2026-96865

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.11.5-tuxcare.4...

@objectstack/cli (>=15.0.0, <=17.0.0), @objectstack/cloud-connection (>=15.1.1, <=17.0.0) +6 more potentially affected by CVE-2026-80192 via @better-auth/sso (>=1.7.0-rc.1, <=1.7.0-rc.2)

@better-auth/sso NPM version =1.7.0-rc.1, =15.0.0, =15.1.1, =15.0.0, =15.1.1, =15.0.0, =15.1.1, =17.0.0-rc.4, =15.1.1, =17.0.0 Source cves: CVE-2026-80192 Source advisory: SNYK:JS-BETTERAUTHSSO-19267832...

CVE-2026-74736: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: reject dev-bound programs bound to a different device clsbpfprogfromefd obtained a SCHEDCLS program via bpfproggettypedev but never verified that a device-bound offloaded program's bound netdev matches the TC...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098938)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098938 advisory. In the Linux kernel, the following vulnerability has been resolved: net: use dstdevrcu in sksetupcaps Use RCU to protect accesses to dst-dev from sksetupcaps and...

OS Command Injection

React create-react-app is vulnerable to OS command injection. The vulnerability is due to improper handling of input in the startBrowserProcess function of openBrowser.js in react-dev-utils, which allows an attacker to manipulate the input and execute arbitrary operating system commands remotely...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the f81604readintcallback function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver relates to the possibility of modifying the contents of a publicly accessible static array. Exploiting this vulnerability could allow an attack...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the f81604readintcallback function in the drivers/crypto/ccp/sev-dev-tsm.c file of the Linux kernel cryptographic accelerator driver is related to incomplete filtering of special elements. Exploiting this vulnerability could allow an attacker to cause a system failure...