https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 21:15:40 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/cleanstart-2026-ze34863 <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ze34863 https://cve.radiocsirt.org/vuln/euvd-2026-333377 EUVD-2026-333377 https://cve.radiocsirt.org/vuln/euvd-2026-333377 https://cve.radiocsirt.org/vuln/fkie_cve-2026-14631 <p>webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.</p> <p>webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malformed Origin header. The malformed value causes an uncaught exception in the host-validation path and crashes the dev server. Impact is limited to availability of the development server, no data disclosure, no code execution. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: keep the dev server bound to localhost (the default) and do not expose it to untrusted networks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-14631 https://cve.radiocsirt.org/vuln/ghsa-m28w-2pqf-7qgj <p><strong>Affected:</strong> npm: webpack-dev-server</p> <p>### Impact</p> <p>An unauthenticated peer that can reach the `webpack-dev-server` process can terminate it by sending either a normal HTTP request with a malformed `Host` header, or a WebSocket upgrade to the default `/ws` endpoint with a malformed `Origin` header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.</p> <p>### Patches</p> <p>Fixed in `webpack-dev-server` 5.2.6 by treating malformed `Host` and `Origin` header values as invalid rather than throwing (see [PR #5699](https://github.com/webpack/webpack-dev-server/pull/5699)).</p> <p>### Workarounds</p> <p>Keep the dev server bound to `localhost` (the default) and do not expose it to untrusted networks.</p> <p><strong>Affected:</strong> npm: webpack-dev-server</p> <p>### Impact</p> <p>An unauthenticated peer that can reach the `webpack-dev-server` process can terminate it by sending either a normal HTTP request with a malformed `Host` header, or a WebSocket upgrade to the default `/ws` endpoint with a malformed `Origin` header. The malformed header triggers an uncaught exception in the host-validation path and crashes the dev server process.</p> <p>### Patches</p> <p>Fixed in `webpack-dev-server` 5.2.6 by treating malformed `Host` and `Origin` header values as invalid rather than throwing (see [PR #5699](https://github.com/webpack/webpack-dev-server/pull/5699)).</p> <p>### Workarounds</p> <p>Keep the dev server bound to `localhost` (the default) and do not expose it to untrusted networks.</p> https://cve.radiocsirt.org/vuln/ghsa-m28w-2pqf-7qgj