PT-2026-75741

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 2.7.1-tuxcare.3...

PT-2026-74474

TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 3.1.14-tuxcare.1...

PT-2026-74826

TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 3.11.2-tuxcare.1...

PT-2026-74813

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.15.1-tuxcare.3...

PT-2026-75607

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.11.0-tuxcare.2...

PT-2026-74847

TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.11.0-tuxcare.1...

PT-2026-75781

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 2.7.1-tuxcare.4...

PT-2026-75424

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.15.2-tuxcare.1...

PT-2026-75634

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 2.7.1-tuxcare.2...

PT-2026-75519

TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.15.2-tuxcare.2...

PT-2026-75608

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 2.11.5-tuxcare.2...

PT-2026-74097

TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 4.15.1-tuxcare.1...

PT-2026-75721

TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 3.1.14-tuxcare.3...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities

Summary Multiple vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-14631 DESCRIPTION:...

webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exceptio...

NPM: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

NPM: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header vulnerability discovered by ? in WordPress Npm webpack-dev-server versions = 5.2.5...

GHSA-M28W-2PQF-7QGJ webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header

Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exceptio...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +323 more potentially affected by CVE-2026-14631 via webpack-dev-server (>=5.0.0, <=5.2.5)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2 and more Source cves: CVE-2026-14631 Source advisory: OSV:GHSA-M28W-2PQF-7Q...

GHSA-F5VJ-F2HX-8M93 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +323 more potentially affected by CVE-2026-14620 via webpack-dev-server (>=5.0.0, <=5.2.5)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2 and more Source cves: CVE-2026-14620 Source advisory: OSV:GHSA-F5VJ-F2HX-8M...