Advisories · Technology

vapor leaf-kit.

Every CVE that names vapor leaf-kit among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-28499 CVE record

CVSS 6.9 Medium

LeafKit's HTML escaping may be skipped for Collection values, enabling XSS
- vapor leaf-kit
- Cross-site scripting (XSS)
- CWE-116
Not analysed yet 18 Mar 2026
CVE-2026-27120 CVE record

CVSS 6.1 Medium

Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster
- vapor leaf-kit
- Cross-site scripting (XSS)
- CWE-75
Not analysed yet 20 Feb 2026
CVE-2021-37634 CVE record

CVSS 7.4 High

LeafKit allows XSS with untrusted user input
- vapor leaf-kit
- Cross-site scripting (XSS)
Not analysed yet 9 Aug 2021