Medium
CVE-2025-46565
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 126
Reset filters
Medium
CVE-2025-32395
Vite has an `server.fs.deny` bypass with an invalid `request-target`
Medium
CVE-2025-31486
Vite allows server.fs.deny to be bypassed with .svg or relative paths
Medium
Exploited in attacks
CVE-2025-31125
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
Medium
CVE-2025-30208
Vite bypasses server.fs.deny when using ?raw??
Critical
CVE-2025-24964
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
Medium
CVE-2025-24963
Vitest browser mode serves arbitrary files
Medium
CVE-2025-24360
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
Medium
CVE-2025-24010
Websites were able to send any requests to the development server and read the response in vite
Low
CVE-2024-53261
@sveltejs/kit vulnerable to XSS on dev mode 404 page
High
CVE-2024-47824
Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
High
CVE-2024-47080
Matrix JavaScript SDK's key history sharing could share keys to malicious devices
Medium
CVE-2024-47885
DOM Clobbering Gadget found in astro's client-side router that leads to XSS
Medium
CVE-2024-47075
Layui has DOM Clobbering gadgets that leads to Cross-site Scripting
Medium
CVE-2024-45812
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS
Medium
CVE-2024-45811
Vite's `server.fs.deny` is bypassed when using `?import&raw`
Medium
CVE-2023-50718
NocoDB SQL Injection vulnerability
Medium
CVE-2024-31207
Vite's `server.fs.deny` did not deny requests for patterns with directories.
High
ghsa-w4hv-vmv9-hgcr
GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`
High
CVE-2024-23641
Sending a GET or HEAD request with a body crashes SvelteKit
High
CVE-2024-23331
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
Medium
CVE-2023-49293
Vite XSS vulnerability in `server.transformIndexHtml` via URL payload
High
CVE-2023-46115
Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables
High
CVE-2023-34092
Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.