webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exceptio...

NPM: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

NPM: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header vulnerability discovered by ? in WordPress Npm webpack-dev-server versions = 5.2.5...

GHSA-M28W-2PQF-7QGJ webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exceptio...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +313 more potentially affected by CVE-2026-14620 via webpack-dev-server (>=5.0.0, <=5.2.2)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2-develop-1171, =0.31.0-alpha.0, =0.58.0-alpha-new-stack.0 and more Source cves: CVE-2026-14620 Sour...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +313 more potentially affected by CVE-2026-14620 via webpack-dev-server (>=5.0.0, <=5.2.2)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2-develop-1171, =0.31.0-alpha.0, =0.58.0-alpha-new-stack.0 and more Source cves: CVE-2026-14620 Sour...

EUVD-2026-41558

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints...

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...

NPM: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

NPM: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints vulnerability discovered by ? in WordPress Npm webpack-dev-server versions = 5.2.5...

GHSA-F5VJ-F2HX-8M93 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

Important: Red Hat Security Advisory: Red Hat Data Grid 8.6.2 security update

An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2024-51315

The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub425964 function of the file /goform/SetOnlineDevName...

CVE-2024-51315

The Tenda TX9 wireless router running firmware version V22.03.02.20 is susceptible to a stack-based buffer overflow vulnerability. The flaw exists within the sub_425964 function of the /goform/SetOnlineDevName file because the system fails to properly validate the length of the input data. Succes...

CVE-2024-51316

The Tenda TX9 wireless router (version V22.03.02.20 ) is susceptible to a buffer overflow vulnerability within the update_dev_name function located in the /goform/SetOnlineDevName file. The root cause is the software's failure to properly validate the length of input data provided to this functio...

CVE-2024-51316

The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the updatedevname function of the file /goform/SetOnlineDevName...

CVE-2024-51316

The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the updatedevname function of the file /goform/SetOnlineDevName...

CVE-2026-64178

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev-name bnepaddconnection needs to keep holding the bnepsessionsem while reading dev-name just like bnepgetconnlist does; otherwise the bnepsession thread can concurrently free the netdevice, whi...

CVE-2026-64162

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

EUVD-2026-45863

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev-name bnepaddconnection needs to keep holding the bnepsessionsem while reading dev-name just like bnepgetconnlist does; otherwise the bnepsession thread can concurrently free the netdevice, whi...

CVE-2026-64178 Bluetooth: bnep: Fix UAF read of dev->name

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: Fix UAF read of dev-name bnepaddconnection needs to keep holding the bnepsessionsem while reading dev-name just like bnepgetconnlist does; otherwise the bnepsession thread can concurrently free the netdevice, whi...