5450 matches found
CLSA-2026-1790884229 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.0-tuxcare.4...
CVE-2026-39363
CVE-2026-39363 — Detección masiva de lectura arbitraria de archivos en Vite Dev Server WebSocket Descargo de responsabilidad: Esta herramienta está destinada únicamente a pruebas de seguridad autorizadas e investigación educativa. Los usuarios deben cumplir con las leyes y regulaciones locales;...
CLSA-2026-1790876768 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 8.1.1-tuxcare.1...
CVE-2026-39363
CVE-2026-39363 — PoC de lectura arbitraria de archivos en Vite Dev Server PoC ejecutable directamente para GHSA-p9ff-h696-f583. A través de un WebSocket HMR sin autenticación, invoca fetchModule, eludiendo la restricción server.fs.allow de la capa HTTP, para leer archivos arbitrarios en la máquin...
php-8.1.0-dev-backdoor-rce
Ejecución remota de código mediante backdoor en PHP 8.1.0-dev Script de shell del sistema con backdoor para PHP 8.1.0-dev La versión de PHP 8.1.0-dev se publicó con un backdoor el 28 de marzo de 2021, pero el backdoor fue rápidamente descubierto y eliminado. Si esta versión de PHP se ejecuta en u...
PHP-8.1.0-dev-Backdoor
PHP 8.1.0-dev User-Agentt Backdoor de Ejecución Remota de Código RCE Severidad: Crítico Equivalente CVSS: 10.0 Tipo de Vulnerabilidad: Backdoor de Cadena de Suministro / Ejecución Remota de Código RCE Software Afectado: PHP 8.1.0-dev Solo Build de Desarrollo Vector de Ataque: Remoto Sin...
CLSA-2026-1790866099 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.4-tuxcare.2...
CLSA-2026-1790866070 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 6.1.3-tuxcare.1...
CVE-2024-3829
CVE-2024-3829 for Qdrant - Exploit THIS IS AN EXPLOIT FOR CVE-2024-3829 IN QDRANT 1.9.0-dev | || | | || | | || || || | | | | | | | | || | | || || || | | || | | || || || | | | | || | | || | | | | || || | || | || | | | | || ||| | || | | || || | | || || | | || || || || | | || | | || || | | | | | | |...
CLSA-2026-1790756051 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 7.4.2-tuxcare.1...
CLSA-2026-1790755864 TuxCare security update for webpack-dev-middleware (1 CVE)
TuxCare rebuilt webpack-dev-middleware to address 1 CVE. Fixed in 5.3.3-tuxcare.2...
Malicious code in brioche-apl-dev-env (npm)
brioche-apl-dev-env is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, worki...
MAL-2026-17432 Malicious code in brioche-apl-dev-env (npm)
brioche-apl-dev-env is a dependency-confusion package: it takes a name that looks like an internal project, uses an inflated version 100.0.0 so it outranks private-registry versions, and runs node setup.js || true as a preinstall script on npm install. setup.js sends the hostname, username, worki...
NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath vulnerability discovered by ? in WordPress Npm webpack-dev-middleware versions 7.4.5...
EUVD-2026-64850
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath...
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...
GHSA-G84C-RXFJ-3J2C webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...
GO-2026-6517 kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp
kcp front-proxy does not strip inbound X-Remote- identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace in github.com/kcp-dev/kcp...
GO-2026-6535 Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState in hatchet in github.com/hatchet-dev/hatchet
Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState in hatchet in github.com/hatchet-dev/hatchet. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If th...