vapor vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20213
3. 20222
4. 20232
5. 20241
6. 20262

Newest CVEs

• CVE-2026-28499

  LeafKit's HTML escaping may be skipped for Collection values, enabling XSS

  vapor · leaf-kit

  Medium6.9
• CVE-2026-27120

  Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster

  vapor · leaf-kit

  Medium6.1
• CVE-2024-21631

  Integer overflow in URI leading to potential host spoofing

  vapor · vapor

  Medium6.5
• CVE-2023-44386

  Incorrect request error handling triggers server crash in Vapor

  vapor · vapor

  Medium5.3
• CVE-2023-31136

  PostgresNIO processes unencrypted bytes from man-in-the-middle

  vapor · postgres-nio

  Low3.7
• CVE-2022-31019

  DoS Vulnerability in URLEncodedFormDecoder in Vapor

  vapor · vapor

  High7.5
• CVE-2022-31005

  Integer Overflow in Vapor's HTTP Range Request

  vapor · vapor

  High7.5
• CVE-2021-37634

  LeafKit allows XSS with untrusted user input

  vapor · leaf-kit

  High7.4
• CVE-2021-32742

  Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash

  vapor · vapor

  High7.5
• CVE-2021-21328

  Denial of Service

  vapor · vapor

  Medium5.3