webpack-dev-server

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. webpack-dev-server vulnerable to cross-site request forgery via internal developer endpointsCVE-2026-14620webpack-dev-server · CVSS 4.7 · 0.5% likely

   CWE-352

2. webpack-dev-server vulnerable to denial of service via a malformed Host or Origin headerCVE-2026-14631webpack-dev-server · CVSS 5.3 · 0.5% likely

   CWE-248

3. webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpointCVE-2026-114348webpack-dev-server · CVSS 5.3 · 0.3% likely

   CWE-209

4. webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS originsCVE-2026-6402webpack-dev-server · CVSS 5.3 · 0.3% likely

   CWE-749

5. webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxiesCVE-2026-9595webpack-dev-server · CVSS 5.3 · 0.2% likely

   CWE-346

6. webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgradesCVE-2026-112085webpack-dev-server · CVSS 8.2 · 0.1% likely

   CWE-1385

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.