What’s Vulnerable › Products

vapor Leafkit vulnerabilities

3 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your vapor Leafkit version is affected

Latest vapor Leafkit vulnerabilities

• CVE-2026-28499 — LeafKit's HTML escaping may be skipped for Collection values, enabling XSS (CVSS 6.1)
• CVE-2026-27120 — Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster (CVSS 6.1)
• CVE-2021-37634 — LeafKit allows XSS with untrusted user input (CVSS 6.1)