Medium
CVE-2026-27125
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 46
Reset filters
Medium
CVE-2026-27122
Svelte SSR does not validate dynamic element tag names in `<svelte:element>`
Medium
CVE-2026-27121
Svelte affected by cross-site scripting via spread attributes in Svelte SSR
Medium
CVE-2026-27119
Svelte affected by XSS in SSR `<option>` element
Medium
CVE-2026-27118
Cache poisoning in @sveltejs/adapter-vercel
High
ghsa-gw32-9rmw-qwww
svelte is vulnerable to XSS with textarea bind:value
Medium
CVE-2025-15265
svelte vulnerable to Cross-site Scripting
High
CVE-2026-22803
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)
High
CVE-2025-67647
SvelteKit is vulnerable to denial of service and possible SSRF when using prerendering
Medium
CVE-2025-65944
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
High
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
High
CVE-2025-62381
`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`
Medium
CVE-2025-32388
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params
Low
ghsa-r5w7-f542-q2j4
Potential DoS when using ContextLines integration
Low
CVE-2024-53261
@sveltejs/kit vulnerable to XSS on dev mode 404 page
Low
CVE-2024-53262
@sveltejs/kit has unescaped error message included on error page
Medium
CVE-2024-45047
Svelte has a potential mXSS vulnerability due to improper HTML escaping
High
CVE-2024-23641
Sending a GET or HEAD request with a body crashes SvelteKit
Medium
CVE-2023-38687
Svelecte item names vulnerable to execution of arbitrary JavaScript
High
CVE-2023-29008
SvelteKit framework has Insufficient CSRF protection for CORS requests
High
CVE-2023-29003
SvelteKit vulnerable to Cross-Site Request Forgery
Medium
CVE-2022-25875
Svelte vulnerable to XSS when using objects during server-side rendering
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.