CloakBin

CloakBin Zero-Knowledge Encrypted Pastebin Your data is encrypted in your browser before it leaves your machine. The server only ever stores ciphertext. Live Demo • Report Bug • Request Feature Share a secret straight from your terminal. It encrypts on your machine before anything uploads: echo...

EUVD-2026-107011

SvelteKit: URL redirection to untrusted site via enhanced form submission...

GHSA-PFHG-Q3QV-9Q6R SvelteKit: URL redirection to untrusted site via enhanced form submission

Impact Applications using enhanced form actions use:enhance on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading...

SvelteKit: URL redirection to untrusted site via enhanced form submission

Impact Applications using enhanced form actions use:enhance on routes that accept paths beginning with //, such as catch-all routes, may be vulnerable to an open redirect. Patches A fix has been prepared for @sveltejs/kit 3.0.0. Users should upgrade to 3.0.0 or later. The fix preserves leading...

EUVD-2026-107012

SvelteKit : XSS via untrusted cache-control header in prerendered page...

SvelteKit : XSS via untrusted cache-control header in prerendered page

Impact Applications that prerender pages and use setHeaders to set a cache-control header from an untrusted source are vulnerable to cross-site scripting XSS. SvelteKit inserts the header value into a tag without escaping it. An attacker who can influence this value at prerender time can break ou...

kestrel

The kernel-level visibility of Falco, with the live UI the kernel-native tools don't ship. Quickstart · Spec · Views · Roadmap Kestrel traces kernel events process exec, file access, network connections with an eBPF agent and streams them to a SvelteKit web app that renders a live activity feed,...

Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pfhg-q3qv-9q6r. This link is maintained to preserve external references. Original Description SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on...

Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27mw-82g8-phjj. This link is maintained to preserve external references. Original Description SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a...

CVE-2026-114060

SvelteKit @sveltejs/kit before 3.0.0 contains an open redirect vulnerability in enhanced form actions use:enhance on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to...

CVE-2026-114062

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server,...

CVE-2026-114063

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114061

SvelteKit @sveltejs/kit before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the conten...

EUVD-2026-107013

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server,...

EUVD-2026-107014

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114062 SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server,...

CVE-2026-114063

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114063 SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114063

SvelteKit (@sveltejs/kit) versions 2.10.0 before 3.0.0 are vulnerable to a path traversal vulnerability within the vite preview server on Windows systems. This flaw allows unauthenticated attackers with network access or a tunnel to the preview server to send crafted requests and read files outsi...

CVE-2026-114062

SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server,...