Product by Svelte
Svelte Sveltekit
10 known vulnerabilities in Svelte Sveltekit (Svelte), 0 of them actively exploited (CISA KEV).
Key figures
10
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-82259 | SvelteKit 2.49.0 before 2.53.3 Denial of Service via form | 7.5 | |
| High | CVE-2026-82261 | SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization | 7.5 | |
| High | CVE-2026-82260 | SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization | 7.5 | |
| Medium | CVE-2026-82256 | SvelteKit before 2.69.1 Denial of Service via Remote Form | 5.3 | |
| High | CVE-2023-29003 | SvelteKit has Insufficient Cross-Site Request Forgery Protection | 8.8 | |
| Medium | CVE-2026-82257 | SvelteKit before 2.69.1 Prototype Pollution via File Input | 4.3 | |
| High | CVE-2023-29008 | SvelteKit framework has Insufficient CSRF protection for CORS requests | 8.8 | |
| Medium | CVE-2026-82258 | SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch | 4.8 | |
| Medium | CVE-2024-53262 | Unescaped error message included on error page in SvelteKit | 5.4 | |
| Medium | CVE-2024-53261 | Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit | 5.4 |