middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-113724 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-113724 Source advisory: OSV:GHSA-43MP-35Q3-X3FQ...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-113722 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-113722 Source advisory: OSV:GHSA-C978-59M8-C77V...

CVE-2026-114139

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139

The Sentry-Javascript SDK for JavaScript contains a middleware bypass vulnerability in its webpack integration for @sentry/nextjs . Versions 9.36.0 through 9.47.2, 10.75.2, and 11.0.0-rc.1 are affected. The root cause is that the integration skips application middleware for all paths under a conf...

CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

CVE-2026-114139 Sentry-Javascript: Middleware Bypass when using Tunnel route

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the webpack integration for @sentry/nextjs skips application middleware for every request path under a configured tunnelRoute, while the tunnel rewrite serves only the exact tunnel pat...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the ClientIPFromXFF process. An attacker can manipulate the client IP address returned by the middleware by appending a trusted-looking proxy address to the X-Forwarded-For header when connecting directly ...

middleware-apm (>=0.1.29, <=0.1.37) potentially affected by CVE-2026-113725 via virtualenv (20.0.17)

virtualenv PYPI version 20.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - middleware-apm =0.1.29, =0.1.37 Source cves: CVE-2026-113725 Source advisory: OSV:GHSA-VXJ4-Q4G9-CRJ7...

npm: Vite: Cross origin script execution through Vite custom middleware

npm: Vite: Cross origin script execution through Vite custom middleware vulnerability discovered by ? in WordPress npm vite versions = 6.4.3...

npm: Vite: Cross origin script execution through Vite custom middleware

npm: Vite: Cross origin script execution through Vite custom middleware vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...

UBUNTU-CVE-2026-112945

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

EUVD-2026-105125

Vite: Cross origin script execution through Vite custom middleware...

GHSA-9JRQ-W75R-8GCW Vite: Cross origin script execution through Vite custom middleware

Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to...

Vite: Cross origin script execution through Vite custom middleware

Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to...