KI
Product
kit
20
CVEs
0
On KEV
9.1
Max CVSS
4
New 30D
Severity mix
Critical 1High 8Medium 11Low 0
Watch
Add kit to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-67647 | 9.1 | Jan 15 | SvelteKit Denial of service and possible SSRF when using prerendering Affected: >= 2.19.0, < 2.49.5 |
| CVE-2026-114063 | 7.5 | Oct 21 | SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows Affected: 2.10.0 before 3.0.0 |
| CVE-2026-82261 | 7.5 | Aug 28 | SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization Affected: 2.49.0 before 2.52.1 |
| CVE-2026-82260 | 7.5 | Aug 28 | SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization Affected: 2.49.0 before 2.52.1 |
| CVE-2026-82259 | 7.5 | Aug 28 | SvelteKit 2.49.0 before 2.53.3 Denial of Service via form Affected: 2.49.0 before 2.53.3 |
| CVE-2026-40074 | 7.5 | Apr 10 | SvelteKit's invalidated redirect in handle hook causes Denial-of-Service Affected: < 2.57.1 |
| CVE-2026-40073 | 7.5 | Apr 10 | SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node Affected: < 2.57.1 |
| CVE-2026-22803 | 7.5 | Jan 15 | SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer Affected: >= 2.49.0, < 2.49.5 |
| CVE-2024-23641 | 7.5 | Jan 24 | Sending a GET or HEAD request with a body crashes SvelteKit Affected: >= 2.0.0, < 2.4.3; >= 2.0.0, < 2.1.2; >= 3.0.0, < 3.0.3; = 4.0.0 |
| CVE-2025-32388 | 5.4 | Apr 15 | SvelteKit allows XSS via tracked search_params Affected: >= 2.0.0, < 2.20.6 |
| CVE-2024-53261 | 5.4 | Nov 25 | Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit Affected: < 2.8.3 |
| CVE-2024-53262 | 5.4 | Nov 25 | Unescaped error message included on error page in SvelteKit Affected: < 2.8.3 |
| CVE-2026-114062 | 5.3 | Oct 21 | SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks Affected: before 3.0.0 |
| CVE-2026-82256 | 5.3 | Aug 28 | SvelteKit before 2.69.1 Denial of Service via Remote Form Affected: before 2.69.1 |
| CVE-2026-66062 | 5.3 | Aug 7 | SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header Affected: < 2.70.2 |
| CVE-2026-27118 | 5.3 | Feb 20 | Cache poisoning in @sveltejs/adapter-vercel Affected: < 6.3.2 |
| CVE-2026-82258 | 4.8 | Aug 28 | SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch Affected: 2.38.0 before 2.60.1 |
| CVE-2026-114061 | 4.7 | Oct 21 | SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages Affected: before 3.0.0 |
| CVE-2026-114060 | 4.7 | Oct 21 | SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions Affected: before 3.0.0 |
| CVE-2026-82257 | 4.3 | Aug 28 | SvelteKit before 2.69.1 Prototype Pollution via File Input Affected: before 2.69.1 |
Showing 20