CVE-2026-6402 webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins Information published. EPSS 0.00 CVE-2026-6402 webpack US Microsoft Security · 27. 5. 10:18