https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:10:08.333274+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T20:10:08.446609+00:00 certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/cleanstart-2026-ui84742 CLEANSTART-2026-UI84742 — Security fix for CVE-2026-9595 applied in: argo-workflows 3.6.19-r8 2026-10-02T20:10:08.446666+00:00

Affected: CleanStart: argo-workflows

Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-327303 EUVD-2026-327303 2026-10-02T20:10:08.446701+00:00 EUVD-2026-327303 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9595 fkie_cve-2026-9595 2026-10-02T20:10:08.446715+00:00

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).

Patches: Fixed in webpack-dev-server@5.2.5.

Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.

 https://cve.radiocsirt.org/vuln/ghsa-mx8g-39q3-5c79 GHSA-mx8g-39q3-5c79 — webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies 2026-10-02T20:10:08.446743+00:00

Affected: npm: webpack-dev-server

### Impact

When a user-configured proxy on `webpack-dev-server` has a broad context (e.g. `/`) and `ws: true`, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and `Origin` header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).

### Patches

Fixed in `webpack-dev-server` 5.2.5.

### Workarounds

Scope user-defined proxy `context` to specific paths instead of `/`, or omit `ws: true` from the proxy entry when WebSocket forwarding is not required.

 https://cve.radiocsirt.org/vuln/rhsa-2026:34794 RHSA-2026:34794 — Red Hat Security Advisory: OpenShift Container Platform 4.22.4 bug fix and security update 2026-10-02T20:10:08.446772+00:00

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-9595 UBUNTU-CVE-2026-9595 2026-10-02T20:10:08.446801+00:00

Affected: Ubuntu:18.04:LTS: node-webpack, Ubuntu:20.04:LTS: node-webpack, Ubuntu:20.04:LTS: vue.js, Ubuntu:22.04:LTS: node-webpack, Ubuntu:22.04:LTS: vue.js, Ubuntu:24.04:LTS: node-webpack, Ubuntu:24.04:LTS: vue.js, Ubuntu:25.10: node-webpack, Ubuntu:25.10: vue.js, Ubuntu:26.04:LTS: node-webpack and 1 more

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in webpack-dev-server@5.2.5. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.