SV
Vendor
Svelte
34
CVEs
0
On KEV
0
New 30D
Products
SV7.8
Svelte
Svelte
13 CVEs0 on KEV0 new
SV8.8
Sveltekit
Svelte
10 CVEs0 on KEV0 new
KI9.1
Kit
Svelte
5 CVEs0 on KEV0 new
DE7.5
Devalue
Svelte
4 CVEs0 on KEV0 new
AD9.1
Adapter-node
Svelte
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-82261 | SV Sveltekit Svelte | 7.5 | Aug 28 | SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization |
| CVE-2026-82260 | SV Sveltekit Svelte | 7.5 | Aug 28 | SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization |
| CVE-2026-82259 | SV Sveltekit Svelte | 7.5 | Aug 28 | SvelteKit 2.49.0 before 2.53.3 Denial of Service via form |
| CVE-2026-82258 | SV Sveltekit Svelte | 4.8 | Aug 28 | SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch |
| CVE-2026-82257 | SV Sveltekit Svelte | 4.3 | Aug 28 | SvelteKit before 2.69.1 Prototype Pollution via File Input |
| CVE-2026-82256 | SV Sveltekit Svelte | 5.3 | Aug 28 | SvelteKit before 2.69.1 Denial of Service via Remote Form |
| CVE-2026-42599 | SV Svelte Svelte | 6.1 | Jun 9 | Cross-site scripting via spread attributes in Svelte SSR |
| CVE-2026-42567 | SV Svelte Svelte | 7.5 | Jun 9 | Svelte: ReDoS in `<svelte:element>` Tag Validation |
| CVE-2026-42573 | SV Svelte Svelte | 6.1 | Jun 9 | Svelte: XSS via DOM Clobbering of Internal Framework State |
| CVE-2026-42570 | DE Devalue Svelte | 7.5 | Jun 9 | Svelte devalue: DoS via sparse array deserialization |
| CVE-2026-40074 | KI Kit Svelte | 7.5 | Apr 10 | SvelteKit's invalidated redirect in handle hook causes Denial-of-Service |
| CVE-2026-40073 | KI Kit Svelte | 7.5 | Apr 10 | SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node |
| CVE-2026-30226 | DE Devalue Svelte | 7.5 | Mar 11 | devalue has prototype pollution in devalue.parse and devalue.unflatten |
| CVE-2026-27902 | SV Svelte Svelte | 5.4 | Feb 26 | Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers |
| CVE-2026-27901 | SV Svelte Svelte | 6.1 | Feb 26 | Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` |
| CVE-2026-27125 | SV Svelte Svelte | 6.8 | Feb 20 | Svelte SSR attribute spreading includes inherited properties from prototype chain |
| CVE-2026-27122 | SV Svelte Svelte | 5.4 | Feb 20 | Svelte SSR does not validate dynamic element tag names in `<svelte:element>` |
| CVE-2026-27121 | SV Svelte Svelte | 5.4 | Feb 20 | Svelte affected by cross-site scripting via spread attributes in Svelte SSR |
| CVE-2026-27119 | SV Svelte Svelte | 5.4 | Feb 20 | Svelte affected by XSS in SSR `<option>` element |
| CVE-2025-15265 | SV Svelte Svelte | 6.1 | Jan 15 | Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR) |
| CVE-2026-22775 | DE Devalue Svelte | 7.5 | Jan 15 | devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse |
| CVE-2026-22774 | DE Devalue Svelte | 7.5 | Jan 15 | devalue vulnerable to denial of service due to memory exhaustion in devalue.parse |
| CVE-2026-22803 | KI Kit Svelte | 7.5 | Jan 15 | SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer |
| CVE-2025-67647 | KI Kit Svelte | 9.1 | Jan 15 | SvelteKit Denial of service and possible SSRF when using prerendering |
| CVE-2024-53261 | SV Sveltekit Svelte | 5.4 | Nov 25 | Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit |
| CVE-2024-53262 | SV Sveltekit Svelte | 5.4 | Nov 25 | Unescaped error message included on error page in SvelteKit |
| CVE-2024-45047 | SV Svelte Svelte | 6.1 | Aug 30 | Potential mXSS vulnerability due to improper HTML escaping in svelte |
| CVE-2024-23641 | AD Adapter-node Svelte | 7.5 | Jan 24 | Sending a GET or HEAD request with a body crashes SvelteKit |
| CVE-2023-29008 | SV Sveltekit Svelte | 8.8 | Apr 6 | The SvelteKit framework offers developers an option to create simple REST APIs |
| CVE-2023-29003 | SV Sveltekit Svelte | 8.8 | Apr 4 | SvelteKit is a web development framework |
| CVE-2022-25875 | SV Svelte Svelte | 6.1 | Jul 12 | The package svelte before 3.49.0 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR… |
| CVE-2021-29261 | SV Svelte Svelte | 7.8 | Apr 5 | The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration |