5450 matches found
CVE-2026-30632: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the createdoc tool...
CVE-2026-30633
The software knowns-dev/knowns version 0.11.4 contains a directory traversal vulnerability. The flaw is triggered by providing a crafted path value to the get_doc and update_doc tools. This vulnerability allows for an improper limitation of a pathname to a restricted directory. No specific remedi...
PT-2026-62075
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get doc and update doc tools...
CVE-2026-47671: Missing Authentication for Critical Function
Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...
CVE-2024-51316
The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the updatedevname function of the file /goform/SetOnlineDevName...
NPM: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
NPM: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header vulnerability discovered by ? in WordPress Npm webpack-dev-server versions = 5.2.5...
GHSA-M28W-2PQF-7QGJ webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exceptio...
@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +323 more potentially affected by CVE-2026-14631 via webpack-dev-server (>=5.0.0, <=5.2.5)
webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2 and more Source cves: CVE-2026-14631 Source advisory: OSV:GHSA-M28W-2PQF-7Q...
webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header
Impact An unauthenticated peer that can reach the webpack-dev-server process can terminate it by sending either a normal HTTP request with a malformed Host header, or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed header triggers an uncaught exceptio...
@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +323 more potentially affected by CVE-2026-14620 via webpack-dev-server (>=5.0.0, <=5.2.5)
webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2 and more Source cves: CVE-2026-14620 Source advisory: OSV:GHSA-F5VJ-F2HX-8M...
GHSA-F5VJ-F2HX-8M93 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...
NPM: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints
NPM: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints vulnerability discovered by ? in WordPress Npm webpack-dev-server versions = 5.2.5...
EUVD-2026-41558
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints...
Important: Red Hat Security Advisory: Red Hat Data Grid 8.6.2 security update
An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration
A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...
CVE-2024-51316
The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the updatedevname function of the file /goform/SetOnlineDevName...
CVE-2024-51316
The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the updatedevname function of the file /goform/SetOnlineDevName...
CVE-2024-51316
The Tenda TX9 wireless router (version V22.03.02.20 ) is susceptible to a buffer overflow vulnerability within the update_dev_name function located in the /goform/SetOnlineDevName file. The root cause is the software's failure to properly validate the length of input data provided to this functio...