Svelte records

32 published records for vendor svelte.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 96.9%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

Bug bounty scope

VercelHackerOne · paid

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

32 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2023-29003No exploit	SvelteKit has Insufficient Cross-Site Request Forgery Protectionsvelte · sveltekit · CWE-184 Pre-auth CSRF	High8.8	—	0.5%	Apr 4, 2023
35Monitor	CVE-2023-29008No exploit	SvelteKit framework has Insufficient CSRF protection for CORS requestssvelte · sveltekit · CWE-918 Pre-auth SSRF CSRF	High8.8	—	0.3%	Apr 6, 2023
34Monitor	CVE-2026-82259No exploit	SvelteKit 2.49.0 before 2.53.3 Denial of Service via formsvelte · sveltekit · CWE-502 Pre-auth Deserialization	High8.7	—	0.5%	Aug 28, 2026
34Monitor	CVE-2026-82261No exploit	SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserializationsvelte · sveltekit · CWE-400 Pre-auth Deserialization Denial of service	High8.7	—	0.4%	Aug 28, 2026
34Monitor	CVE-2026-82260No exploit	SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserializationsvelte · sveltekit · CWE-400 Pre-auth Deserialization Denial of service	High8.7	—	0.4%	Aug 28, 2026
33Monitor	CVE-2025-67647No exploit	SvelteKit Denial of service and possible SSRF when using prerenderingsvelte · adapter-node · CWE-248 Pre-auth SSRF	High8.4	—	0.5%	Jan 15, 2026
32Monitor	CVE-2026-22803No exploit	SvelteKit has a memory amplification DoS in Remote Functions binary form deserializersvelte · kit · CWE-789 Pre-auth Deserialization	High8.2	—	0.5%	Jan 15, 2026
32Monitor	CVE-2026-40073No exploit	SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-nodesvelte · kit · CWE-770 Pre-auth Denial of service	High8.2	—	0.5%	Apr 10, 2026
31Monitor	CVE-2021-29261No exploit	The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace consvelte · svelte RCE	High7.8	—	1.3%	Apr 5, 2021
30Monitor	CVE-2024-23641No exploit	Sending a GET or HEAD request with a body crashes SvelteKitsvelte · adapter-node · CWE-20 Pre-auth Denial of service	High7.5	—	0.7%	Jan 24, 2024
30Monitor	CVE-2026-22774No exploit	devalue vulnerable to denial of service due to memory exhaustion in devalue.parsesvelte · devalue · CWE-405 Pre-auth Denial of service	High7.5	—	0.6%	Jan 15, 2026
30Monitor	CVE-2026-22775No exploit	devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parsesvelte · devalue · CWE-405 Pre-auth Denial of service	High7.5	—	0.6%	Jan 15, 2026
30Monitor	CVE-2026-42570No exploit	Svelte devalue: DoS via sparse array deserializationsvelte · devalue · CWE-770 Pre-auth Deserialization Denial of service	High7.5	—	0.3%	Jun 9, 2026
27Monitor	CVE-2026-82256No exploit	SvelteKit before 2.69.1 Denial of Service via Remote Formsvelte · sveltekit · CWE-400 Pre-auth Denial of service	Medium6.9	—	0.4%	Aug 28, 2026
25Monitor	CVE-2026-30226No exploit	devalue has prototype pollution in devalue.parse and devalue.unflattensvelte · devalue · CWE-1321 Pre-auth Prototype pollution	Medium6.3	—	0.4%	Mar 11, 2026
25Monitor	CVE-2026-40074No exploit	SvelteKit's invalidated redirect in handle hook causes Denial-of-Servicesvelte · kit · CWE-755 Pre-auth	Medium6.3	—	0.3%	Apr 10, 2026
24Monitor	CVE-2022-25875No exploit	Cross-site Scripting (XSS)svelte · svelte · CWE-79 Pre-auth XSS	Medium6.1	—	1.4%	Jul 12, 2022
24Monitor	CVE-2024-45047No exploit	Potential mXSS vulnerability due to improper HTML escaping in sveltesvelte · svelte · CWE-79 Pre-auth XSS	Medium6.1	—	0.3%	Aug 30, 2024
23Monitor	CVE-2026-42567No exploit	Svelte: ReDoS in `<svelte:element>` Tag Validationsvelte · svelte · CWE-1333 Denial of service	Medium5.9	—	0.4%	Jun 9, 2026
23Monitor	CVE-2026-82258No exploit	SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batchsvelte · sveltekit · CWE-362 Race condition	Medium5.9	—	0.2%	Aug 28, 2026
21Monitor	CVE-2026-27125No exploit	Svelte SSR attribute spreading includes inherited properties from prototype chainsvelte · svelte · CWE-915	Medium5.3	—	0.4%	Feb 20, 2026
21Monitor	CVE-2026-82257No exploit	SvelteKit before 2.69.1 Prototype Pollution via File Inputsvelte · sveltekit · CWE-1321 Pre-auth Prototype pollution	Medium5.3	—	0.3%	Aug 28, 2026
21Monitor	CVE-2025-15265No exploit	Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)svelte · svelte · CWE-79 Pre-auth XSS	Medium5.3	—	0.3%	Jan 15, 2026
21Monitor	CVE-2026-42573No exploit	Svelte: XSS via DOM Clobbering of Internal Framework Statesvelte · svelte · CWE-79 XSS	Medium5.3	—	0.3%	Jun 9, 2026
21Monitor	CVE-2026-27902No exploit	Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markerssvelte · svelte · CWE-79 Pre-auth XSS	Medium5.3	—	0.2%	Feb 25, 2026

CVE-2023-29003
35Monitor
SvelteKit has Insufficient Cross-Site Request Forgery Protection
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
svelte · sveltekitApr 4, 2023
CVE-2023-29008
35Monitor
SvelteKit framework has Insufficient CSRF protection for CORS requests
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- SSRF
- CSRF
svelte · sveltekitApr 6, 2023
CVE-2026-82259
34Monitor
SvelteKit 2.49.0 before 2.53.3 Denial of Service via form
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Deserialization
svelte · sveltekitAug 28, 2026
CVE-2026-82261
34Monitor
SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Deserialization
- Denial of service
svelte · sveltekitAug 28, 2026
CVE-2026-82260
34Monitor
SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Deserialization
- Denial of service
svelte · sveltekitAug 28, 2026
CVE-2025-67647
33Monitor
SvelteKit Denial of service and possible SSRF when using prerendering
HighCVSS 8.4No exploitEPSS 0%
- Pre-auth
- SSRF
svelte · adapter-nodeJan 15, 2026
CVE-2026-22803
32Monitor
SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Deserialization
svelte · kitJan 15, 2026
CVE-2026-40073
32Monitor
SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
svelte · kitApr 10, 2026
CVE-2021-29261
31Monitor
The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace con
HighCVSS 7.8No exploitEPSS 1%
- RCE
svelte · svelteApr 5, 2021
CVE-2024-23641
30Monitor
Sending a GET or HEAD request with a body crashes SvelteKit
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
svelte · adapter-nodeJan 24, 2024
CVE-2026-22774
30Monitor
devalue vulnerable to denial of service due to memory exhaustion in devalue.parse
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
svelte · devalueJan 15, 2026
CVE-2026-22775
30Monitor
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
svelte · devalueJan 15, 2026
CVE-2026-42570
30Monitor
Svelte devalue: DoS via sparse array deserialization
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Deserialization
- Denial of service
svelte · devalueJun 9, 2026
CVE-2026-82256
27Monitor
SvelteKit before 2.69.1 Denial of Service via Remote Form
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- Denial of service
svelte · sveltekitAug 28, 2026
CVE-2026-30226
25Monitor
devalue has prototype pollution in devalue.parse and devalue.unflatten
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
- Prototype pollution
svelte · devalueMar 11, 2026
CVE-2026-40074
25Monitor
SvelteKit's invalidated redirect in handle hook causes Denial-of-Service
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
svelte · kitApr 10, 2026
CVE-2022-25875
24Monitor
Cross-site Scripting (XSS)
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
svelte · svelteJul 12, 2022
CVE-2024-45047
24Monitor
Potential mXSS vulnerability due to improper HTML escaping in svelte
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
svelte · svelteAug 30, 2024
CVE-2026-42567
23Monitor
Svelte: ReDoS in `<svelte:element>` Tag Validation
MediumCVSS 5.9No exploitEPSS 0%
- Denial of service
svelte · svelteJun 9, 2026
CVE-2026-82258
23Monitor
SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch
MediumCVSS 5.9No exploitEPSS 0%
- Race condition
svelte · sveltekitAug 28, 2026
CVE-2026-27125
21Monitor
Svelte SSR attribute spreading includes inherited properties from prototype chain
MediumCVSS 5.3No exploitEPSS 0%
svelte · svelteFeb 20, 2026
CVE-2026-82257
21Monitor
SvelteKit before 2.69.1 Prototype Pollution via File Input
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Prototype pollution
svelte · sveltekitAug 28, 2026
CVE-2025-15265
21Monitor
Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR)
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- XSS
svelte · svelteJan 15, 2026
CVE-2026-42573
21Monitor
Svelte: XSS via DOM Clobbering of Internal Framework State
MediumCVSS 5.3No exploitEPSS 0%
- XSS
svelte · svelteJun 9, 2026
CVE-2026-27902
21Monitor
Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- XSS
svelte · svelteFeb 25, 2026