https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 01:10:37 +0000 https://cve.radiocsirt.org/vuln/cve-2026-14620 <p><strong>Affected:</strong> webpack-dev-server</p> <p>webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server&#39;s own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer&#39;s editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer&#39;s machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.</p> <p><strong>Affected:</strong> webpack-dev-server</p> <p>webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server&#39;s own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer&#39;s editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer&#39;s machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none.</p> https://cve.radiocsirt.org/vuln/cve-2026-14620