Most recent entries from all

certfr-2026-avi-1233 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1233

CLEANSTART-2026-UI84742 — Security fix for CVE-2026-9595 applied in: argo-workflows 3.6.19-r8

Affected: CleanStart: argo-workflows

Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-327303

fkie_cve-2026-9595

Patches: Fixed in webpack-dev-server@5.2.5.

Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.

GHSA-mx8g-39q3-5c79 — webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies

Affected: npm: webpack-dev-server

### Impact

When a user-configured proxy on `webpack-dev-server` has a broad context (e.g. `/`) and `ws: true`, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and `Origin` header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket).

### Patches

Fixed in `webpack-dev-server` 5.2.5.

### Workarounds

Scope user-defined proxy `context` to specific paths instead of `/`, or omit `ws: true` from the proxy entry when WebSocket forwarding is not required.

RHSA-2026:34794 — Red Hat Security Advisory: OpenShift Container Platform 4.22.4 bug fix and security update

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object Kubelet: CRI-O: kube-apiserver: Kubelet, CRI-O, kube-apiserver: Denial of Service via SPDY streaming code github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution

UBUNTU-CVE-2026-9595

Affected: Ubuntu:18.04:LTS: node-webpack, Ubuntu:20.04:LTS: node-webpack, Ubuntu:20.04:LTS: vue.js, Ubuntu:22.04:LTS: node-webpack, Ubuntu:22.04:LTS: vue.js, Ubuntu:24.04:LTS: node-webpack, Ubuntu:24.04:LTS: vue.js, Ubuntu:25.10: node-webpack, Ubuntu:25.10: vue.js, Ubuntu:26.04:LTS: node-webpack and 1 more

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g. /) and ws: true, it also intercepts the dev server's own HMR WebSocket and forwards it to the proxy target. This leaks the browser's cookies and Origin header to the backend, bypasses the dev server's Host/Origin validation, and corrupts the HMR socket (both HMR and the proxy end up writing to the same socket). Patches: Fixed in webpack-dev-server@5.2.5. Workarounds: Scope user-defined proxy context to specific paths instead of /, or omit ws: true from the proxy entry when WebSocket forwarding is not required.