VI
Vendor
vitejs
38
CVEs
1
On KEV
16
New 30D
Products
VI7.5
vite-plus
vitejs
11 CVEs0 on KEV7 new
VI8.3
vite
vitejs
22 CVEs1 on KEV6 new
LA8.3
launch-editor
vitejs
5 CVEs0 on KEV3 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112948 | VI vite-plus vitejs | 6.5 | Oct 20 | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file |
| CVE-2026-112947 | VI vite-plus vitejs | 6.3 | Oct 20 | Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` |
| CVE-2026-112946 | VI vite vitejs | 6.3 | Oct 20 | Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine |
| CVE-2026-112945 | VI vite-plus vitejs | 2.1 | Oct 20 | Vite: Cross origin script execution through Vite custom middleware |
| CVE-2026-112944 | VI vite vitejs | 6.3 | Oct 20 | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors |
| CVE-2026-112943 | VI vite vitejs | 6.3 | Oct 20 | launch-editor: escapeCmdArgs() omits % escaping on Windows |
| CVE-2026-112942 | VI vite vitejs | 7.5 | Oct 20 | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows |
| CVE-2026-53571 | VI vite vitejs | 7.5 | Jun 22 | Vite: `server.fs.deny` bypass on Windows alternate paths |
| CVE-2026-53632 | VI vite vitejs | 5.5 | Jun 22 | NTLMv2 hash disclosure via UNC path handling on Windows |
| CVE-2024-52011 | VI vite vitejs | 8.3 | Jun 1 | launch-editor vulnerable to command injection via the crafted request on Windows |
| CVE-2026-39365 | VI vite vitejs | 5.3 | Apr 7 | Vite has a Path Traversal in Optimized Deps `.map` Handling |
| CVE-2026-39364 | VI vite-plus vitejs | 7.5 | Apr 7 | Vite has a `server.fs.deny` bypass with queries |
| CVE-2026-39363 | VI vite vitejs | 7.5 | Apr 7 | Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket |
| CVE-2025-58752 | VI Vite Vitejs | 5.3 | Sep 8 | Vite is a frontend tooling framework for JavaScript |
| CVE-2025-58751 | VI Vite Vitejs | 5.3 | Sep 8 | Vite is a frontend tooling framework for JavaScript |
| CVE-2025-46565 | VI Vite Vitejs | 5.3 | May 1 | Vite is a frontend tooling framework for javascript |
| CVE-2025-31125 In wildKEV | VI vite vitejs | 7.5 | Mar 31 | Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query |
| CVE-2025-30208 | VI Vite Vitejs | 7.5 | Mar 24 | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 |
| CVE-2025-24010 | VI Vite Vitejs | 6.5 | Jan 20 | Vite is a frontend tooling framework for javascript |
| CVE-2024-23331 | VI Vite Vitejs | 7.5 | Jan 19 | Vite is a frontend tooling framework for javascript |
| CVE-2023-49293 | VI Vite Vitejs | 6.1 | Dec 4 | Vite is a website frontend framework |
| CVE-2023-34092 | VI Vite Vitejs | 7.5 | Jun 1 | Vite provides frontend tooling |
| CVE-2022-35204 | VI Vite Vitejs | 4.3 | Aug 18 | Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service |