CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

GHSA-5XRQ-8626-4RWP When Vitest UI server is listening, arbitrary file can be read and executed

Summary Arbitrary file can be read on Windows when Vitest UI server is listening, especially when exposed to the network. Impact Only users that match either of the following conditions are affected: - explicitly exposes the Vitest UI server to the network using --api.host or api.host config opti...

The vulnerability of the Nginx UI server’s user interface lies in the lack of origin verification in WebSockets, allowing attackers to disclose confidential information.

The vulnerability of the Nginx UI server’s user interface lies in the lack of origin verification in WebSockets. Exploiting this vulnerability allows an attacker to disclose confidential information remotely...

CLEANSTART-2026-FO93349 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-33186, CVE-2026-40890, ghsa-77fj-vx54-gvh7, ghsa-p77j-4mvh-x3m3 applied in versions: 2.44.0-r0, 2.48.2-r0

Multiple security vulnerabilities affect the temporal-ui-server-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

The vulnerability of the Nginx UI server’s user interface relates to synchronization errors when using a shared resource. This allows attackers to cause service failures or execute arbitrary code.

The vulnerability of the Nginx UI server’s user interface is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

CVE-2026-42283

DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the...

CVE-2026-42283 DevSpace UI Server WebSocket CheckOrigin does not validate source

DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the...

CVE-2026-42283: Missing Authentication for Critical Function

DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the...

The vulnerability of the Nginx UI server’s user interface allows attackers to bypass existing security measures.

The vulnerability of the Nginx UI server’s user interface is related to the disclosure of information. Exploiting this vulnerability can allow a malicious actor to bypass existing security measures remotely...

The vulnerability of the Nginx UI server’s user interface allows a hacker to modify data within the system.

The vulnerability of the Nginx UI server’s user interface is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a remote attacker to modify data within the system...

CVE-2026-40890 vulnerabilities

Vulnerabilities for packages: temporal-ui-server, temporal, snyk-cli, kube-metrics-adapter, fq...

GHSA-77FJ-VX54-GVH7 vulnerabilities

Vulnerabilities for packages: temporal-ui-server, temporal, snyk-cli, kube-metrics-adapter, fq...

GHSA-77FJ-VX54-GVH7 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter, fq, temporal-ui-server, temporal, kube-metrics-adapter-fips, gotenberg, temporal-ui-server-fips, temporal-fips, snyk-cli...

CVE-2026-40890 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter, fq, temporal-ui-server, temporal, kube-metrics-adapter-fips, gotenberg, temporal-ui-server-fips, temporal-fips, snyk-cli...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: cloudbeat, image-factory, multus-cni-fips, net-kourier-fips, cert-manager-csi-driver-fips, kubescape, portieris-fips, podinfo-fips, kubernetes-csi-driver-nfs-fips, mc, chaos-mesh-fips, contour-fips, rancher-support-bundle-kit, kubernetes-csi-external-resizer-fips,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: portieris-fips, age, contour-fips, crossplane-provider-kubernetes, seaweedfs-operator-fips, go, apko, kubernetes-csi-external-snapshotter-fips, kyverno-policy-reporter-plugins-kyverno, protoc-gen-go, traefik, cert-manager-cmctl, coredns, rancher-agent, net-kourier,...

The vulnerability of the GetConfPath() function in the Nginx UI server’s user interface allows a hacker to write arbitrary files.

The vulnerability of the GetConfPath function in the Nginx UI server’s user interface is related to the improper handling of JSON fields, resulting in incorrect values being retrieved without proper validation. This issue arises due to a faulty restriction on the path to the restricted directory...

ui-server 安全漏洞

ui-server is an open source library from temporal.io. A security vulnerability exists in ui-server versions prior to 2.25.0, which stems from a cross-site scripting XSS vulnerability in the timeline page...

PT-2024-20370

Name of the Vulnerable Software and Affected Versions Temporal UI Server affected versions not specified Description The issue allows an attacker with pre-existing access to send a signal to a workflow to execute a script when a victim views the signal. This is achieved by making the signal name ...

The vulnerability of the app.ini configuration file of the Nginx UI server allows a hacker to execute arbitrary code.

The vulnerability of the app.ini configuration file of the Nginx UI server involves a lack of measures to eliminate special elements during the processing of parameters testconfigcmd and startcmd. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...