WE
Vendor
webpack
6
CVEs
0
On KEV
0
New 30D
Products
WE6.1
webpack
webpack
3 CVEs0 on KEV0 new
WE6.5
webpack-dev-server
webpack
2 CVEs0 on KEV0 new
WE7.5
webpack-dev-middleware
webpack
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-68157 | WE webpack webpack | 3.7 | Feb 5 | webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects |
| CVE-2025-68458 | WE webpack webpack | 3.7 | Feb 5 | webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior |
| CVE-2025-30360 | WE webpack-dev-server webpack | 6.5 | Jun 3 | webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser |
| CVE-2025-30359 | WE webpack-dev-server webpack | 5.9 | Jun 3 | webpack-dev-server users' source code may be stolen when they access a malicious web site |
| CVE-2024-43788 | WE webpack webpack | 6.1 | Aug 27 | DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS) |
| CVE-2024-29180 | WE webpack-dev-middleware webpack | 7.5 | Mar 21 | webpack-dev-middleware Path Traversal vulnerability |