medium · CVSS v3 4.7

CVE-2026-114061

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cach…

Description

SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.7
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-114088

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

View analysis

medium

CVE-2026-114054

vLLM before 0.31.0 contains a cache aliasing flaw that lets authenticated users collide cache keys via EXIF ImageID or cache_salt, potentially leaking cached media or reusing KV state. The vulnerability can be exploited by supplying crafted values in image metadata or LoRA names. It affects all deployments of vLLM older than 0.31.0.

View analysis

medium

CVE-2026-114056

ArcadeDB versions 26.8.1 to 26.10.0 contain an authorization bypass that lets read‑only users alter edge type schema flags without UPDATE_SCHEMA rights. This change persists across restarts and can affect data integrity.

View analysis

medium

CVE-2026-114057

ArcadeDB versions 26.2.1 through 26.10.0 allow authenticated users to enumerate all database names via the Bolt protocol, exposing tenant or project identifiers. The missing authorization flaw can be triggered with a simple SHOW DATABASES query. This vulnerability is present in the Bolt handler and can be exploited by any user with database credentials.

View analysis