High
CVE-2026-92708
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 46
Reset filters
Medium
ghsa-4q55-j62x-fr9h
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
Medium
CVE-2026-81176
Svelte devalue: DoS via malformed input
Medium
CVE-2026-66062
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header
Medium
CVE-2026-82257
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
Medium
CVE-2026-82256
SvelteKit: Big remote form function payloads can cause Node process to crash
Medium
CVE-2026-82258
@sveltejs/kit: `query.batch` cross-talk
Medium
ghsa-f3cj-j4f6-wq85
Svelte: SSR XSS via Insecure Promise Serialization in hydratable
Medium
CVE-2026-42573
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
Medium
CVE-2026-42567
Svelte: ReDoS in `<svelte:element>` Tag Validation
High
CVE-2026-45665
Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order
High
CVE-2026-42570
Svelte devalue: DoS via sparse array deserialization
Medium
CVE-2026-42599
Svelte SSR vulnerable to cross-site scripting via spread attributes
High
CVE-2026-44721
open-webui Vulnerable to Stored XSS via Model Description
Low
CVE-2026-6216
DbGate has cross site scripting via the SVG Icon String Handler component
Medium
CVE-2026-40074
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-Service
High
CVE-2026-40073
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypass
High
CVE-2026-34725
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
Low
ghsa-mwv9-gp5h-frr4
Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties
Low
CVE-2026-82259
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)
Medium
CVE-2026-27902
Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
Medium
CVE-2026-27901
Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent`
Medium
CVE-2026-82261
CPU exhaustion in SvelteKit remote form deserialization (experimental only)
Medium
CVE-2026-82260
Memory exhaustion in SvelteKit remote form deserialization (experimental only)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.