WE
Vendor
Webpack.js
15
CVEs
0
On KEV
0
New 30D
Products
WE7.5
Webpack-dev-server
Webpack.js
7 CVEs0 on KEV0 new
WE9.8
Webpack
Webpack.js
4 CVEs0 on KEV0 new
LO9.8
Loader-utils
Webpack.js
3 CVEs0 on KEV0 new
WE7.5
Webpack-dev-middleware
Webpack.js
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-14631 | WE Webpack-dev-server Webpack.js | 5.3 | Jul 3 | webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header |
| CVE-2026-14620 | WE Webpack-dev-server Webpack.js | 4.7 | Jul 3 | webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints |
| CVE-2026-9595 | WE Webpack-dev-server Webpack.js | 4.3 | Jun 15 | webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies |
| CVE-2026-6402 | WE Webpack-dev-server Webpack.js | 6.5 | May 12 | webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins |
| CVE-2025-68157 | WE Webpack Webpack.js | 3.7 | Feb 5 | webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects |
| CVE-2025-68458 | WE Webpack Webpack.js | 3.7 | Feb 5 | webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior |
| CVE-2025-30360 | WE Webpack-dev-server Webpack.js | 6.5 | Jun 3 | webpack-dev-server allows users to use webpack with a development server that provides live reloading |
| CVE-2025-30359 | WE Webpack-dev-server Webpack.js | 5.9 | Jun 3 | webpack-dev-server allows users to use webpack with a development server that provides live reloading |
| CVE-2024-43788 | WE Webpack Webpack.js | 6.1 | Aug 27 | Webpack is a module bundler |
| CVE-2024-29180 | WE Webpack-dev-middleware Webpack.js | 7.5 | Mar 21 | Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning… |
| CVE-2023-28154 | WE Webpack Webpack.js | 9.8 | Mar 13 | Webpack 5 before 5.76.0 does not avoid cross-realm object access |
| CVE-2022-37603 | LO Loader-utils Webpack.js | 7.5 | Oct 14 | A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in… |
| CVE-2022-37601 | LO Loader-utils Webpack.js | 9.8 | Oct 12 | Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js |
| CVE-2022-37599 | LO Loader-utils Webpack.js | 7.5 | Oct 11 | A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in… |
| CVE-2018-14732 | WE Webpack-dev-server Webpack.js | 7.5 | Sep 21 | An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6 |