[ Vendor · 5 CVEs ]
sveltejs
CVEs affecting sveltejs published in the last 30 days, plus any sveltejs CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114060 | 21 Oct 2026 | CVSS 4.7 | sveltejs kitSvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths… | |
| CVE-2026-114061 | 21 Oct 2026 | CVSS 4.7 | sveltejs kitSvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set… | |
| CVE-2026-114062 | 21 Oct 2026 | CVSS 5.3 | sveltejs kitSvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because… | |
| CVE-2026-114063 | 21 Oct 2026 | CVSS 7.5 | sveltejs kitSvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows… | |
| CVE-2026-92708 | 18 Sep 2026 | CVSS 7.5 | devalue: `stringify`/`uneval` serialize shared memorySvelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0… | Fix |