https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-28T00:04:44.440092+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-266580 EUVD-2026-266580 2026-10-28T00:04:44.442108+00:00 EUVD-2026-266580 https://cve.radiocsirt.org/vuln/fkie_cve-2025-56648 fkie_cve-2025-56648 2026-10-28T00:04:44.442138+00:00

npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them.

 https://cve.radiocsirt.org/vuln/ghsa-qm9p-f9j5-w83w GHSA-qm9p-f9j5-w83w — Parcel has an Origin Validation Error vulnerability 2026-10-28T00:04:44.442168+00:00

Affected: npm: @parcel/reporter-dev-server

parcel versions 1.6.1 and above have an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them. Version 2.16.4 supports a `--no-cors` option which disables CORS headers in the dev server.