530 matches found
CVE-2026-94486
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
CVE-2026-94486
The Next.js React framework contains a vulnerability in the next dev development server, specifically affecting versions 16.0.0 through 16.3.8 . The server exposes a Model Context Protocol (MCP) endpoint that fails to reliably restrict cross-site requests. This flaw allows an attacker to issue un...
CLSA-2026-1790944348 TuxCare security update for webpack-dev-server (2 CVEs)
TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 4.9.3-tuxcare.2...
Linux Distros Unpatched Vulnerability : CVE-2026-94485
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protoco...
CVE-2026-94486: Origin Validation Error
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...
CLSA-2026-1790863106 TuxCare security update for webpack-dev-server (2 CVEs)
TuxCare rebuilt webpack-dev-server to address 2 CVEs. Fixed in 5.2.5-tuxcare.1...
CLEANSTART-2026-YT66630 webpack-dev-server allows users to use webpack with a development server that provides live reloading
Security vulnerability affects the argo-workflows package. webpack-dev-server allows users to use webpack with a development server that provides live reloading...
CLSA-2026-1790604947 TuxCare security update for webpack-dev-server (4 CVEs)
TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 4.9.3-tuxcare.1...
CLSA-2026-1790004677 TuxCare security update for webpack-dev-server (3 CVEs)
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 5.2.2-tuxcare.2...
PT-2026-105282
TuxCare rebuilt webpack-dev-server to address 3 CVEs. Fixed in 5.2.2-tuxcare.2...
VulnCheck KEV: CVE-2026-39364
Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny e.g., .env, .crt can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are...
webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration
A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...
webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration
A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...
EUVD-2026-69705
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock...
Vite - Information Disclosure
Vite is a frontend tooling framework for JavaScript.In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended wi...
CLSA-2026-1787931162 TuxCare security update for webpack-dev-server (1 CVE)
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 5.2.2-tuxcare.1...
PT-2026-86902
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 5.2.2-tuxcare.1...
CLSA-2026-1787837620 TuxCare security update for webpack-dev-server (1 CVE)
TuxCare rebuilt webpack-dev-server to address 1 CVE. Fixed in 4.15.2-tuxcare.3...