web-infra-dev has 3 CVEs on record. 2 were published in the last 90 days. The median CVSS is 7.5 (high).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 1
Weakness classes
Products
- midscene 1
- rsbuild 1
- rsdoctor 1
Worst active — by depth score
CVE-2026-61782High· 7.5Rsdoctor is a build analyzer tailored for projects built with Rspack53CVE-2026-59804Medium· 6.8Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote attackers to hijack active bridge sessions by opening a cross-or…49CVE-2026-10144High· 7.8Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS43
web-infra-dev vulnerabilities
CVEs affecting web-infra-dev, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-61782High· 7.5PoCRsdoctor is a build analyzer tailored for projects built with Rspack
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /a…
CVE-2026-10144High· 7.8Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS
Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser(…
CVE-2026-59804Medium· 6.8PoCMidscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote attackers to hijack active bridge sessions by opening a cross-or…
Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote attackers to hijack active bridge sessions by opening a cross-or…