https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:44:53.228744+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T20:44:53.280423+00:00 certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/cleanstart-2026-ze34863 CLEANSTART-2026-ZE34863 — Security fix for CVE-2026-14631 applied in: argo-workflows 3.6.19-r8 2026-10-03T20:44:53.280468+00:00

Affected: CleanStart: argo-workflows

Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-333377 EUVD-2026-333377 2026-10-03T20:44:53.280500+00:00 EUVD-2026-333377 https://cve.radiocsirt.org/vuln/fkie_cve-2026-14631 fkie_cve-2026-14631 2026-10-03T20:44:53.280514+00:00

webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.

 https://cve.radiocsirt.org/vuln/ghsa-m28w-2pqf-7qgj GHSA-m28w-2pqf-7qgj — webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header 2026-10-03T20:44:53.280539+00:00

Affected: npm: webpack-dev-server

### Impact

An unauthenticated peer that can reach the `webpack-dev-server` process can terminate it by sending either a normal HTTP request with a malformed `Host` header, or a WebSocket upgrade to the default `/ws` endpoint with a malformed `Origin` header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.

### Patches

Fixed in `webpack-dev-server` 5.2.6 by treating malformed `Host` and `Origin` header values as invalid rather than throwing (see [PR #5699](https://github.com/webpack/webpack-dev-server/pull/5699)).

### Workarounds

Keep the dev server bound to `localhost` (the default) and do not expose it to untrusted networks.