KI
Product
kit
20
CVEs
0
On KEV
9.1
Max CVSS
4
New 30D
Severity mix
Critical 1High 8Medium 11Low 0
Watch
Add kit to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-32388 | 5.4 | Apr 15 | SvelteKit allows XSS via tracked search_params Affected: >= 2.0.0, < 2.20.6 |
| CVE-2024-53261 | 5.4 | Nov 25 | Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit Affected: < 2.8.3 |
| CVE-2024-53262 | 5.4 | Nov 25 | Unescaped error message included on error page in SvelteKit Affected: < 2.8.3 |
| CVE-2026-114062 | 5.3 | Oct 21 | SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks Affected: before 3.0.0 |
| CVE-2026-82256 | 5.3 | Aug 28 | SvelteKit before 2.69.1 Denial of Service via Remote Form Affected: before 2.69.1 |
| CVE-2026-66062 | 5.3 | Aug 7 | SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header Affected: < 2.70.2 |
| CVE-2026-27118 | 5.3 | Feb 20 | Cache poisoning in @sveltejs/adapter-vercel Affected: < 6.3.2 |
| CVE-2026-82258 | 4.8 | Aug 28 | SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch Affected: 2.38.0 before 2.60.1 |
| CVE-2026-114061 | 4.7 | Oct 21 | SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages Affected: before 3.0.0 |
| CVE-2026-114060 | 4.7 | Oct 21 | SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions Affected: before 3.0.0 |
| CVE-2026-82257 | 4.3 | Aug 28 | SvelteKit before 2.69.1 Prototype Pollution via File Input Affected: before 2.69.1 |
Showing 11