GHSA-RGV6-XP99-6MGJ Gitea Remember-Me Token Theft Not Invalidating Attacker Session

The vulnerability is in the Remember-Me giteaincredible token validation logic, specifically when handling a compromised token hash mismatch. The vulnerable function is this one: https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/authtoken.goL33-L64...

SUSE CVE-2026-64064

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsinvalidatefolio to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfsfolio struct hung off of folio-privat...

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...

EUVD-2026-41558

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints...

GHSA-F5VJ-F2HX-8M93 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

Impact The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can...

EUVD-2026-45637

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsinvalidatefolio to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfsfolio struct hung off of folio-privat...

CVE-2026-64064 netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsinvalidatefolio to clear dirty bit if all changes gone If a streaming write is made, this will leave the relevant modified folio in a not-uptodate, but dirty state with a netfsfolio struct hung off of folio-privat...

PT-2026-61381

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfs component where netfs invalidate folio fails to clear the dirty bit when all changes in a folio are removed during a file truncation. This leaves the folio i...

SUSE CVE-2026-14620

webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any websi...

Cross-site Request Forgery (CSRF)

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the open-editor and invalidate endpoints. An attacker can open...

Cross-site Request Forgery (CSRF)

Overview org.webjars.npm:webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the open-editor and invalidate endpoints. An...

CVE-2026-14620

webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any websi...

CVE-2026-14620 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any websi...

CVE-2026-14620 webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any websi...

CVE-2026-14620

webpack-dev-server prior to 5.2.6 exposes two internal endpoints (/webpack-dev-server/open-editor and /webpack-dev-server/invalidate) that perform state-changing actions on any GET request without origin verification. This enables cross-origin interactions when a user visits any website while the...

CVE-2026-14620: Cross-Site Request Forgery (CSRF)

webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any websi...

PT-2026-55575

Name of the Vulnerable Software and Affected Versions webpack-dev-server versions prior to 5.2.6 Description Internal developer endpoints '/webpack-dev-server/open-editor' and '/webpack-dev-server/invalidate' perform state-changing actions on GET requests without verifying the request origin. Thi...

EUVD-2026-40988

In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI errata on various Arm CPUs A number of CPUs developed by Arm suffer from errata whereby a broadcast TLBI;DSB sequence may complete before the global observation of writes which are translated by an...

SUSE CVE-2026-53062

In the Linux kernel, the following vulnerability has been resolved: dm cache policy smq: fix missing locks in invalidating cache blocks In passthrough mode, the policy invalidatemapping operation is called simultaneously from multiple workers, thus it should be protected by a lock. Otherwise, we...

FreeBSD : FreeBSD -- Use-after-free in device pager page list (5a34b147-74e0-11f1-958d-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5a34b147-74e0-11f1-958d-bc241121aa0a advisory. When msyncMSINVALIDATE is called on a mapping of an unmanaged device object, the physical pages in the...