EUVD-2026-64850

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

GHSA-8XWF-RJM4-XVHV oras-go has file store write outside workingDir via symlink traversal

The file content store in oras-go attempts to confine writes to workingDir when AllowPathTraversalOnWrite=false, but the guard is lexical and does not account for symlink traversal. If workingDir contains a symlink path component and an attacker-controlled blob title via ocispec.AnnotationTitle...

PT-2026-80854

Name of the Vulnerable Software and Affected Versions webpack-dev-middleware versions 5.3.4 through 5.x webpack-dev-middleware versions 6.1.2 through 6.x webpack-dev-middleware versions 7.1.0 through 7.x Description The software fails to sufficiently validate URL addresses before returning local...