edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57179 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57179 Source advisory:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57178 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57178 Source advisory:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57177 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57177 Source advisory:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57176 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57176 Source advisory:...

edx-oauth2-wordpress-backend (>=1.0.0, <=1.0.4), richie (>=2.13.0, <=2.14.1) +2 more potentially affected by CVE-2026-57175 via social-auth-core (4.2.0)

social-auth-core PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - edx-oauth2-wordpress-backend =1.0.0, =2.13.0, =14.0.0, =4.11.0, =4.12.2 Source cves: CVE-2026-57175 Source advisory:...

GHSA-JMG2-RCXH-W8Q3 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...

@doubao-apps/kit (>=0.0.18-canary-d3f0f27b-20260319141130, <=0.0.35), @ecom-mfe/rspack-config (>=1.0.1, <=1.0.2) +63 more potentially affected by CVE-2026-61782 via @rsdoctor/rspack-plugin (>=1.0.0-rc.0, <=1.5.13)

@rsdoctor/rspack-plugin NPM version =1.0.0-rc.0, =0.0.18-canary-d3f0f27b-20260319141130, =1.0.1, =3.7.0-beta.0, =0.1.0-next.21, =0.0.2-next.12, =0.0.2-next.12, =0.0.2-next.12, =3.0.0-0, =0.8.4, =0.8.4-canary-20250312-c1294cbe, =0.0.1, =1.29.0-beta.1, =3.5.2, =6.4.0-beta.4, =6.4.4-beta.5 and more...

@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Summary The default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS Access-Control-Allow-Origin: . Any network-adjacent or remote attacker can send a single...

@doubao-apps/kit (>=0.0.18-canary-d3f0f27b-20260319141130, <=0.0.35), @ecom-mfe/rspack-config (>=1.0.1, <=1.0.2) +63 more potentially affected by CVE-2026-61782 via @rsdoctor/rspack-plugin (>=1.0.0-rc.0, <=1.5.13)

@rsdoctor/rspack-plugin NPM version =1.0.0-rc.0, =0.0.18-canary-d3f0f27b-20260319141130, =1.0.1, =3.7.0-beta.0, =0.1.0-next.21, =0.0.2-next.12, =0.0.2-next.12, =0.0.2-next.12, =3.0.0-0, =0.8.4, =0.8.4-canary-20250312-c1294cbe, =0.0.1, =1.29.0-beta.1, =3.5.2, =6.4.0-beta.4, =6.4.4-beta.5 and more...

CVE-2026-61782

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

EUVD-2026-86323

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by "@rsdoctor/rspack-plugin" binds to all network interfaces "0.0.0.0" and serves a "POST /api/data/key" endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782 @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint with no authentication and wildcard CORS...

CVE-2026-61782

The @rsdoctor/rspack-plugin (prior to version 1.5.16 ) contains an unauthenticated HTTP API that exposes sensitive build information. The default Rsdoctor report server binds to all network interfaces (0.0.0.0 ) and provides a POST /api/data/key endpoint with no authentication and wildcard CORS. ...

@aumi/aumi (>=0.1.0, <=0.1.5), @aumi/bundler-rsbuild (>=0.1.0, <=0.1.5) +85 more potentially affected by CVE-2026-61782 via @rsdoctor/rspack-plugin (>=0.1.10, <=1.5.13)

@rsdoctor/rspack-plugin NPM version =0.1.10, =0.1.0, =0.1.0, =0.0.0-6105, =0.0.18-canary-d3f0f27b-20260319141130, =1.0.1, =3.1.0-rc.6, =0.1.0-next.21, =0.0.2-next.12, =0.0.2-next.12, =0.0.2-next.12, =1.1.0, =3.0.0-0, =0.5.5, =0.8.2 and more Source cves: CVE-2026-61782 Source advisory:...

Exploit for CVE-2026-12227

CVE-2026-12227 — Visual Composer Website Builder Unauthenticat...

SUSE CVE-2026-66068

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOGDEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentialsobfuscation:decrypt called in...

SUSE CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...