{"vulnerability": "cve-2026-6402", "sightings": [{"uuid": "bb49ab59-a72f-47d0-90f5-a6dd526a6050", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6402", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mlncojczic27", "content": "\ud83d\udea8 Medium-severity security fix in webpack-dev-server@5.2.4 just released!\n\nPatches CVE-2026-6402 \u2014 webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins\n\ngithub.com/webpack/webp...", "creation_timestamp": "2026-05-12T07:53:37.570694Z"}, {"uuid": "9d0db4ed-5e28-4f12-a31b-2043915687cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6402", "type": "seen", "source": "https://gist.github.com/alon710/6c307c7259353f2c5a97793055cbda6e", "content": "# CVE-2026-6402: CVE-2026-6402: Cross-Origin Source Code Exposure in webpack-dev-server\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-05-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-6402\n\n## Summary\nA medium-severity vulnerability in webpack-dev-server versions up to 5.2.3 allows malicious external websites to exfiltrate an application's entire source code when the development server is accessed over plain HTTP. The vulnerability leverages cross-origin script inclusion to bypass origin restrictions.\n\n## TL;DR\nwebpack-dev-server <= 5.2.3 fails to block cross-origin script inclusions over HTTP due to missing Fetch Metadata headers, enabling attackers to steal local source code by hooking global webpack registry functions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-749\n- **Attack Vector**: Network (Requires User Interaction)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00033\n- **Impact**: High Confidentiality Loss\n- **Exploit Status**: Proof of Concept\n- **CISA KEV**: Not Listed\n\n## Affected Systems\n\n- webpack-dev-server <= 5.2.3\n- **webpack-dev-server**: <= 5.2.3 (Fixed in: `5.2.4`)\n\n## Mitigation\n\n- Upgrade webpack-dev-server to version 5.2.4 or later\n- Run the development server over TLS (HTTPS) to enforce secure contexts\n- Restrict the allowedHosts configuration directive to specific domains\n\n**Remediation Steps:**\n1. Identify projects utilizing webpack-dev-server versions <= 5.2.3\n2. Update package.json dependencies to require webpack-dev-server ^5.2.4\n3. Run npm install or yarn install to apply the updated dependencies\n4. Review webpack configuration files to remove 'allowedHosts: all' entries\n5. Implement HTTPS for local development environments where possible\n\n## References\n\n- [NVD Entry for CVE-2026-6402](https://nvd.nist.gov/vuln/detail/CVE-2026-6402)\n- [GitHub Security Advisory GHSA-79cf-xcqc-c78w](https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-79cf-xcqc-c78w)\n- [OpenJS Foundation Advisory](https://cna.openjsf.org/security-advisories.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-6402) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-18T14:40:50.000000Z"}, {"uuid": "1971f131-4a61-4cc8-92fc-ee1cf5bef50d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64020", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20261002", "content": "", "creation_timestamp": "2026-10-01T18:00:00.000000Z"}, {"uuid": "0e3c7f6b-7705-4463-9ca3-b13bd3db7c89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64021", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20261002", "content": "", "creation_timestamp": "2026-10-01T18:00:00.000000Z"}, {"uuid": "0413ef62-2d41-457c-972e-d91dfe1575cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64022", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20261002", "content": "", "creation_timestamp": "2026-10-01T18:00:00.000000Z"}, {"uuid": "b57a5cb0-3d8e-4392-bcfc-42b28fce801a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64023", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20261002", "content": "", "creation_timestamp": "2026-10-01T18:00:00.000000Z"}, {"uuid": "276d2c18-735a-4a0f-8667-d68207d26e7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64024", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20261002", "content": "", "creation_timestamp": "2026-10-01T18:00:00.000000Z"}, {"uuid": "cc6d18c1-9e80-4b41-82d0-6c4b09e003fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64025", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20261002", "content": "", "creation_timestamp": "2026-10-01T18:00:00.000000Z"}, {"uuid": "4a234bc5-00f6-4607-ad49-31bb17026259", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64026", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20261002", "content": "", "creation_timestamp": "2026-10-01T18:00:00.000000Z"}, {"uuid": "596d4a0a-f033-4627-b08e-6610783f6abb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64027", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20261002", "content": "", "creation_timestamp": "2026-10-01T18:00:00.000000Z"}, {"uuid": "592e630e-263b-440e-acef-f82895ceaa20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-64029", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities_20261002", "content": "", "creation_timestamp": "2026-10-01T18:00:00.000000Z"}, {"uuid": "6eaf86a0-f686-4b77-ab5d-5951fc8a862d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-64025", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxh2ugstb322", "content": "CVE-2026-64025 - linux\nThe Linux kernel versions used in Ubuntu cloud images have a flaw in how encrypted network data is processed. This can lead to corrupted or lost data when TLS traffic is\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#linux #canonical #Ubuntu1604LTS #CVE #infosec", "creation_timestamp": "2026-10-09T13:20:05.139316Z"}]}