CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

CVE-2026-47429

Vitest (a Vite-based testing framework) is affected by CVE-2026-47429 due to an incorrect isFileServingAllowed check in the Vitest UI/API server on Windows for the path /vitest_attachment . This allows a ?..\ path traversal to read files outside the project, and could enable arbitrary script exec...

CVE-2026-47429

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

Microsoft Patches a Record 570 Security Flaws

Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeonin...

EUVD-2026-44117

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network...

EUVD-2026-44078

Buffer over-read in Windows Kernel allows an authorized attacker to disclose information locally...

EUVD-2026-44068

Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network...

EUVD-2026-44074

Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network...

EUVD-2026-43943

Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally...

EUVD-2026-43904

Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally...

EUVD-2026-43871

Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network...

EUVD-2026-43878

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network...

EUVD-2026-43776

Improper neutralization of special elements used in a command 'command injection' in Windows Narrator Braille allows an authorized attacker to elevate privileges locally...

EUVD-2026-43770

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Print Spooler Components allows an authorized attacker to execute code over a network...

EUVD-2026-44020

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network...

EUVD-2026-44013

Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally...

EUVD-2026-43984

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally...

EUVD-2026-43986

Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network...

EUVD-2026-43793

Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network...

CVE-2026-58638

Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally...