Vulnerabilities
Last updated 39 minutes ago
| Package | Summary | Severity | Published | Modified |
|---|---|---|---|---|
vite
|
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows | High Risk 8.0 | 1 hour ago | 1 hour ago |
|
vite-plus
|
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows | High Risk 8.0 | 1 hour ago | 1 hour ago |
|
vite
|
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors | Medium Risk 6.0 | 1 hour ago | 1 hour ago |
|
vite-plus
|
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors | Medium Risk 6.0 | 1 hour ago | 1 hour ago |
|
vite
|
launch-editor: escapeCmdArgs() omits % escaping on Windows | Medium Risk 6.0 | 3 hours ago | 2 hours ago |
|
vite-plus
|
launch-editor: escapeCmdArgs() omits % escaping on Windows | Medium Risk 6.0 | 3 hours ago | 2 hours ago |
vitess.io/vitess
|
Vitess vttablet /twopcz reflected XSS | Critical 9.8 | 5 days ago | 5 days ago |
|
@quasar/app-vite
|
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories | Medium Risk 6.0 | 13 days ago | 13 days ago |
|
@quasar/app-vite
|
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained | High Risk 8.0 | 13 days ago | 13 days ago |
|
@quasar/app-vite
|
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions | High Risk 8.0 | 13 days ago | 13 days ago |
|
@quasar/app-vite
|
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable | High Risk 8.0 | 13 days ago | 13 days ago |
|
@quasar/app-vite
|
Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory | Medium Risk 6.0 | 13 days ago | 13 days ago |
|
vite-plugin-crypto
|
Malicious code in vite-plugin-crypto (npm) | Unknown | 22 days ago | 20 days ago |
|
vite-dev-launcher
|
Malicious code in vite-dev-launcher (npm) | Unknown | 27 days ago | 27 days ago |
|
@vite-tab/tabui
|
Malicious code in @vite-tab/tabui (npm) | Unknown | 28 days ago | 27 days ago |
|
@vitemirrorte/element-plus-vite-cli
|
Malicious code in @vitemirrorte/element-plus-vite-cli (npm) | Unknown | 27 days ago | 27 days ago |
|
@vite-mcp/vite-type
|
Malicious code in @vite-mcp/vite-type (npm) | Unknown | 3 months ago | 28 days ago |
|
@vite-pro/vite-ui
|
Malicious code in @vite-pro/vite-ui (npm) | Unknown | 3 months ago | 28 days ago |
|
@vite-ts/vite-ui
|
Malicious code in @vite-ts/vite-ui (npm) | Unknown | 3 months ago | 28 days ago |
|
@vitets/vite-ts
|
Malicious code in @vitets/vite-ts (npm) | Unknown | 3 months ago | 28 days ago |
|
@vite-tab/tab
|
Malicious code in @vite-tab/tab (npm) | Unknown | 3 months ago | 28 days ago |
|
element-plus-vite-cli
|
Malicious code in element-plus-vite-cli (npm) | Unknown | 29 days ago | 29 days ago |
|
vitess.io/vitess
|
Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data | Medium Risk 5.3 | 2 months ago | 1 month ago |
|
vitess.io/vitess
|
Missing authorization on vttablet /debug/vrlog in vitess.io/vitess | Unknown | 1 month ago | 1 month ago |
|
@vitest/browser
|
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate | Critical 9.4 | 3 months ago | 1 month ago |
|
vite
|
launch-editor vulnerable to command injection via the crafted request on Windows | High Risk 8.0 | 4 months ago | 1 month ago |
|
@vitest/browser
|
Vitest browser mode serves unsanitized otelCarrier query parameter as inline script | Critical 9.6 | 4 months ago | 1 month ago |
|
@tanstack/nitro-v2-vite-plugin
|
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys | Critical 9.6 | 5 months ago | 1 month ago |
|
@tanstack/router-vite-plugin
|
Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys | Critical 9.6 | 5 months ago | 1 month ago |
|
vite
|
Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket | High Risk 8.0 | 6 months ago | 1 month ago |
|
vite
|
Vite has an `server.fs.deny` bypass with an invalid `request-target` | Medium Risk 6.0 | 1 year ago | 1 month ago |
|
vite
|
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query | Medium Risk 5.3 | 1 year ago | 1 month ago |
|
vite
|
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows | Medium Risk 6.0 | 4 months ago | 1 month ago |
|
vite-plus
|
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows | Medium Risk 6.0 | 4 months ago | 1 month ago |
|
vite
|
vite: `server.fs.deny` bypass on Windows alternate paths | High Risk 7.5 | 4 months ago | 1 month ago |
|
vite-plus
|
vite: `server.fs.deny` bypass on Windows alternate paths | High Risk 7.5 | 4 months ago | 1 month ago |
|
vitest
|
When Vitest UI server is listening, arbitrary file can be read and executed | Critical 9.8 | 4 months ago | 1 month ago |
|
vite
|
Vite: `server.fs.deny` bypassed with queries | High Risk 8.0 | 6 months ago | 1 month ago |
|
vite
|
Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling | Medium Risk 6.0 | 6 months ago | 1 month ago |
|
vite
|
vite allows server.fs.deny bypass via backslash on Windows | Medium Risk 6.0 | 1 year ago | 1 month ago |
|
vite
|
Vite middleware may serve files starting with the same name with the public directory | Low Risk 3.0 | 1 year ago | 1 month ago |
|
vite
|
Vite's `server.fs` settings were not applied to HTML files | Low Risk 3.0 | 1 year ago | 1 month ago |
|
vite
|
Vite's server.fs.deny bypassed with /. for files under project root | Medium Risk 6.0 | 1 year ago | 1 month ago |
|
vite
|
Vite bypasses server.fs.deny when using ?raw?? | Medium Risk 5.3 | 1 year ago | 1 month ago |
|
vite
|
Websites were able to send any requests to the development server and read the response in vite | Medium Risk 6.5 | 1 year ago | 1 month ago |
|
vite
|
Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS | Medium Risk 6.4 | 2 years ago | 1 month ago |
|
vite
|
Vite's `server.fs.deny` is bypassed when using `?import&raw` | Medium Risk 5.3 | 2 years ago | 1 month ago |
|
github.com/vitessio/vitess
|
Vitess vulnerable to infinite memory consumption and vtgate crash | Medium Risk 4.9 | 2 years ago | 1 month ago |
|
vitess.io/vitess
|
Vitess vulnerable to infinite memory consumption and vtgate crash | Medium Risk 4.9 | 2 years ago | 1 month ago |
|
vite
|
Vite's `server.fs.deny` did not deny requests for patterns with directories. | Medium Risk 5.9 | 2 years ago | 1 month ago |
Page 1