Product by Vite
Vite-plus
12 known vulnerabilities in Vite-plus (Vite), 0 of them actively exploited (CISA KEV).
Key figures
12
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-39363 | Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket | 7.5 | |
| High | CVE-2026-39364 | Vite has a `server.fs.deny` bypass with queries | 7.5 | |
| High | CVE-2026-112942 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows | — | |
| Medium | CVE-2026-112946 | Vitejs: Path Traversal | — | |
| Medium | CVE-2026-112944 | Vite Launch-editor: Argument Injection | — | |
| High | CVE-2026-53571 | Vite: `server.fs.deny` bypass on Windows alternate paths | 7.5 | |
| Medium | CVE-2026-39365 | Vite has a Path Traversal in Optimized Deps `.map` Handling | 5.3 | |
| Medium | CVE-2026-112947 | Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` | — | |
| Medium | CVE-2026-112948 | Vitest: Files or Directories Accessible to External Parties | 6.5 | |
| Medium | CVE-2026-112943 | launch-editor: escapeCmdArgs() omits % escaping on Windows | — | |
| Low | CVE-2026-112945 | Vite: Cross origin script execution through Vite custom middleware | — | |
| Medium | CVE-2026-53632 | NTLMv2 hash disclosure via UNC path handling on Windows | — |