6538 matches found
CVE-2026-30633: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the getdoc and updatedoc tools...
CVE-2026-30632: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the createdoc tool...
CVE-2026-47671: Missing Authentication for Critical Function
Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...
CVE-2026-30633
The software knowns-dev/knowns version 0.11.4 contains a directory traversal vulnerability. The flaw is triggered by providing a crafted path value to the get_doc and update_doc tools. This vulnerability allows for an improper limitation of a pathname to a restricted directory. No specific remedi...
PT-2026-62075
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get doc and update doc tools...
CVE-2024-51316
The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the updatedevname function of the file /goform/SetOnlineDevName...
@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +313 more potentially affected by CVE-2026-14631 via webpack-dev-server (>=5.0.0, <=5.2.2)
webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2-develop-1171, =0.31.0-alpha.0, =0.58.0-alpha-new-stack.0 and more Source cves: CVE-2026-14631 Sour...
@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +313 more potentially affected by CVE-2026-14631 via webpack-dev-server (>=5.0.0, <=5.2.2)
webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2-develop-1171, =0.31.0-alpha.0, =0.58.0-alpha-new-stack.0 and more Source cves: CVE-2026-14631 Sour...
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exceptio...
NPM: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
NPM: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header vulnerability discovered by ? in WordPress Npm webpack-dev-server versions = 5.2.5...
GHSA-M28W-2PQF-7QGJ webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exceptio...
@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +313 more potentially affected by CVE-2026-14620 via webpack-dev-server (>=5.0.0, <=5.2.2)
webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2-develop-1171, =0.31.0-alpha.0, =0.58.0-alpha-new-stack.0 and more Source cves: CVE-2026-14620 Sour...
@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +313 more potentially affected by CVE-2026-14620 via webpack-dev-server (>=5.0.0, <=5.2.2)
webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2-develop-1171, =0.31.0-alpha.0, =0.58.0-alpha-new-stack.0 and more Source cves: CVE-2026-14620 Sour...
EUVD-2026-41558
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints...
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...
NPM: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
NPM: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints vulnerability discovered by ? in WordPress Npm webpack-dev-server versions = 5.2.5...
GHSA-F5VJ-F2HX-8M93 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...
webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration
A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...
Important: Red Hat Security Advisory: Red Hat Data Grid 8.6.2 security update
An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
