CVE-2026-76844

webpack-dev-middleware suffers from a path traversal vulnerability in its getFilenameFromUrl function, an incomplete fix for CVE-2024-29180 . When publicPath is configured without a trailing slash, a crafted request (e.g., GET /assets../.env against publicPath /assets) bypasses the UP_PATH_REGEXP...

EUVD-2026-64850

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

Vite - Path Traversal

Vite versions prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13 contain a file exposure vulnerability caused by improper handling of request URLs with '' in the dev server running on Node or Bun, letting attackers access arbitrary files, exploit requires the server to be exposed to the network an...

Vite server.fs.deny Bypass - Local File Inclusion

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...

Vite dev server - Cross-Site Scripting

Vite's dev server, when used with appType: 'custom' and manually invoking server.transformIndexHtml using the unmodified request URL, is vulnerable to XSS via a crafted URL payload. If the HTML being served includes an inline module script ..., an attacker can inject a script via the URL,...

Vite Dev Server - Path Traversal in Optimized Deps .map Handling

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

EUVD-2026-64371

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

PT-2026-79635

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6 dev get from resurrecting inet6 dev in6 dev get reads dev-ip6 ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these...

ROOT-APP-NPM-CVE-2026-6402 CVE-2026-6402 in webpack-dev-server - Patched by Root

Root has patched CVE-2026-6402 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-30359 CVE-2025-30359 in webpack-dev-server - Patched by Root

Root has patched CVE-2025-30359 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-30360 CVE-2025-30360 in webpack-dev-server - Patched by Root

Root has patched CVE-2025-30360 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-14620 CVE-2026-14620 in webpack-dev-server - Patched by Root

Root has patched CVE-2026-14620 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9595 CVE-2026-9595 in webpack-dev-server - Patched by Root

Root has patched CVE-2026-9595 in the webpack-dev-server package for Root:npm. Multiple fixed versions available...

UBUNTU-CVE-2026-63495

Libevent is an event notification library. From 2.2.0-alpha-dev until...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...

GHSA-RGR9-R7MJ-MF6X Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...

EUVD-2026-62971

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

Malicious code in reqcrypt-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb6f64adb9e9635c1060d7c40db6006cad5446b87dcd7b20ceeb8ee7c6980f8 The package presents itself as a requests-style HTTP client but its response processor inspects every JSON response for the magic keys payloaddd,...