CVE-2026-106106

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

CVE-2026-106106

The Quasar Framework contains a vulnerability in its SSR/SSG development error path where the renderSSRError() function in utils/render-ssr-error/src/index.js serializes sensitive data, including process.env , request headers, and cookies. Because the development server listens on all interfaces ...

CVE-2026-94485

The Next.js framework (versions 16.0.0 through 16.3.8 ) contains a vulnerability in the next dev development server. The server exposes a Model Context Protocol (MCP) endpoint that lacks reliable restrictions on cross-site requests . If a developer visits a malicious website while the development...

CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94486 Next.js: Information disclosure in the Next.js development server's Model Context Protocol endpoint

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

Linux Distros Unpatched Vulnerability : CVE-2026-94486

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protoco...

PT-2026-104378

Name of the Vulnerable Software and Affected Versions Next.js versions 16.0.0 through 16.3.7 Description The development server in this React framework for building full-stack web applications exposes a Model Context Protocol endpoint that does not reliably restrict cross-site requests. This allo...

CVE-2026-102811

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-102811 Marmite through 0.4.2 Unauthenticated API Access via Development Server

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-102811 Marmite through 0.4.2 Unauthenticated API Access via Development Server

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-102810 Marmite through 0.4.2 Path Traversal via Development Server

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handlerequest function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...

CVE-2026-102810

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handlerequest function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...

CVE-2026-102810 Marmite through 0.4.2 Path Traversal via Development Server

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handlerequest function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...

CVE-2026-102810

Marmite versions through 0.4.2 are vulnerable to a path traversal vulnerability in the development server initiated via the --serve flag. The root cause is located in the handle_request function within src/server.rs, which fails to reject .. segments after percent-decoding and joining the request...

EUVD-2026-89110

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handlerequest function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...

CVE-2026-102810 Marmite through 0.4.2 Path Traversal via Development Server

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handlerequest function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...

CVE-2026-102811: Missing Authentication for Critical Function

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

Malicious code in development-server-electron-builder-hermes (npm)

Source: amazon-inspector b5665caf467f0f567035e4af0bc17752525fe75d750c4233aaaadc7d9522ecd2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-84373 Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without...