Login Request a demo
VI
Product
vite-plus
by vitejs · last CVE Oct 20, 2026
11
CVEs
0
On KEV
7.5
Max CVSS
7
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 0High 3Medium 7Low 1
Severity
All severities11Critical0High3Medium7Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add vite-plus to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-112948
6.5
0%
Oct 20
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file
Affected: >= 1.0.0-rc.0, < 1.3.0
CVE-2026-112947
6.3
1%
Oct 20
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Affected: >= 0.2.8, < 1.1.0
CVE-2026-112946
6.3
1%
Oct 20
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
Affected: < 1.1.0
CVE-2026-112944
6.3
1%
Oct 20
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
Affected: < 1.1.0
CVE-2026-112943
6.3
0%
Oct 20
launch-editor: escapeCmdArgs() omits % escaping on Windows
Affected: < 1.1.0
CVE-2026-53632
5.5
0%
Jun 22
NTLMv2 hash disclosure via UNC path handling on Windows
Affected: < 0.1.24
CVE-2026-39365
5.3
1%
Apr 7
Vite has a Path Traversal in Optimized Deps `.map` Handling
Affected: < 0.1.16
Showing 7