VI
Vendor
@vitest
5
CVEs
0
On KEV
4
New 30D
Products
MO5.9
mocker
@vitest
3 CVEs0 on KEV2 new
BR6.5
browser
@vitest
1 CVEs0 on KEV1 new
UI6.5
ui
@vitest
1 CVEs0 on KEV1 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-112950 | MO mocker @vitest | 5.9 | Oct 20 | Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix |
| CVE-2026-112949 | MO mocker @vitest | 4.7 | Oct 20 | Vitest: Code injection via unauthenticated manual mock registration |
| CVE-2026-112948 | BR browser @vitest | 6.5 | Oct 20 | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file |
| CVE-2026-84373 | MO mocker @vitest | 5.9 | Sep 1 | Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock |