https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:50:38 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/cleanstart-2026-ky31390 <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ky31390 https://cve.radiocsirt.org/vuln/euvd-2026-333378 EUVD-2026-333378 https://cve.radiocsirt.org/vuln/euvd-2026-333378 https://cve.radiocsirt.org/vuln/fkie_cve-2026-14620 <p>webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server&#39;s own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer&#39;s editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer&#39;s machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.</p> <p>webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server&#39;s own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer&#39;s editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer&#39;s machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-14620 https://cve.radiocsirt.org/vuln/ghsa-f5vj-f2hx-8m93 <p><strong>Affected:</strong> npm: webpack-dev-server</p> <p>### Impact</p> <p>The internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints perform state-changing actions on any `GET` request, without verifying that the request originated from the dev server&#39;s own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.</p> <p>An attacker can open an arbitrary existing local file in the developer&#39;s editor, including files outside the project root (e.g. `~/.ssh/config`). The file&#39;s contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer&#39;s machine.</p> <p>### Patches</p> <p>Fixed in `webpack-dev-server` 5.2.6 by rejecting cross-site requests to the `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints (see [PR #5698](https://github.com/webpack/webpack-dev-server/pull/5698)).</p> <p>### Workarounds</p> <p>None</p> <p><strong>Affected:</strong> npm: webpack-dev-server</p> <p>### Impact</p> <p>The internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints perform state-changing actions on any `GET` request, without verifying that the request originated from the dev server&#39;s own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.</p> <p>An attacker can open an arbitrary existing local file in the developer&#39;s editor, including files outside the project root (e.g. `~/.ssh/config`). The file&#39;s contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer&#39;s machine.</p> <p>### Patches</p> <p>Fixed in `webpack-dev-server` 5.2.6 by rejecting cross-site requests to the `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints (see [PR #5698](https://github.com/webpack/webpack-dev-server/pull/5698)).</p> <p>### Workarounds</p> <p>None</p> https://cve.radiocsirt.org/vuln/ghsa-f5vj-f2hx-8m93