browser vulnerabilities

CVEs whose affected-version data names the browser package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-112948Medium· 6.5

today

Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compile…

▾ Sunlitvitest-dev · vitestvia CVEORG