CVE-2026-6402 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, arangodb, kubeflow-katib, argo-workflows...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +313 more potentially affected by CVE-2025-30359 +2 more via webpack-dev-server (>=5.0.0, <=5.2.2)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2-develop-1171, =0.31.0-alpha.0, =0.58.0-alpha-new-stack.0 and more Source cves: CVE-2025-30359,...

Linux Distros Unpatched Vulnerability : CVE-2026-6402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +313 more potentially affected by CVE-2025-30359 +1 more via webpack-dev-server (>=5.0.0, <=5.2.2)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2-develop-1171, =0.31.0-alpha.0, =0.58.0-alpha-new-stack.0 and more Source cves: CVE-2025-30359,...

CVE-2026-6402

creationtimestamp| type| source ---|---|--- 2026-05-12 07:53:37+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mlncojczic27 2026-05-18 14:40:50+00:00| seen| https://gist.github.com/alon710/6c307c7259353f2c5a97793055cbda6e...

CVE-2026-6402 webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for...

-react-file-list-components (1.1.1), -tompan-reacttemplate (>=1.0.1, <=1.1.0) +48441 more potentially affected by CVE-2026-6402 via webpack-dev-server (>=1.2.9, <=5.2.2)

webpack-dev-server NPM version =1.2.9, =1.0.1, =0.1.0, =1.0.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 and more Source cves: CVE-2026-6402 Source...

CVE-2026-6402 webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins

webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentially trustworthy origin such as plain HTTP. The previous fix relied on the Sec-Fetch-Mode and Sec-Fetch-Site request headers, which browsers omit for...