How many CVEs does Vapor have?

Vapor has 11 published CVE records since 2020, including 2 in the last two years.

How many Vapor CVEs are in CISA KEV?

None of Vapor's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Vapor products have the most CVEs?

The Vapor products with the most published CVEs are vapor, github.com/vapor/vapor, github.com/vapor/leaf-kit, leafkit, leaf-kit.

What are the most common weakness types in Vapor CVEs?

Vapor's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-190 (Integer Overflow or Wraparound), CWE-20 (Improper Input Validation), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

Are there public exploits for Vapor vulnerabilities?

Yes — 4 of Vapor's CVEs have a known public exploit.

How many critical Vapor vulnerabilities are there?

Vapor has 1 critical and 4 high-severity CVEs.

What is the average severity of Vapor CVEs?

The average CVSS base score across Vapor's scored CVEs is 6.9.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

11 CVEs

Vapor Vulnerabilities

Name: Vapor vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Vapor.

11

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

4

Public exploits

PoC or exploit code

6.9

Avg CVSS

2020–2026

Overview

Vapor has 11 published CVE records since 2020, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 4 have a known public exploit. The average CVSS base score across scored CVEs is 6.9.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Vapor products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Vapor's vulnerability posture, as a share of its 11 published CVEs.

Average CVSS: 6.9
Critical / high: 45%
Actively exploited (KEV): 0%
Public exploit available: 36%
Patch available: 100%

Severity and exploitation

How the CVSS severity of Vapor's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High4

Medium6

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Vapor's CVEs are currently listed in CISA's KEV catalog.

Public exploits

4

4 of Vapor's CVEs have a known public exploit available.

Most affected products

The Vapor products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Vapor CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Vapor CVE records.

GitHub_M11 CVEs

Disclosure activity by year

How many Vapor CVEs were published each year.

2020

1

2021

3

2022

2

2023

2

2024

1

2026

2

Latest Vapor CVEs

The most recently disclosed vulnerabilities affecting Vapor.

LeafKit's HTML escaping may be skipped for Collection values, enabling XSS
CWE-80
Medium · CVSS 6.9
EPSS 0.3%2026-03-18
Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster
CWE-79
Medium · CVSS 6.1
EPSS 0.2%2026-02-20
Integer overflow in URI leading to potential host spoofing
CWE-20
Medium · CVSS 6.5
EPSS 0.6%2024-01-03
Incorrect request error handling triggers server crash in Vapor
CWE-617
Medium · CVSS 5.3
EPSS 0.6%2023-10-05
Medium vulnerability · 2023-05-09
CWE-522
Medium · CVSS 5.9
EPSS 0.5%2023-05-09
DoS Vulnerability in URLEncodedFormDecoder in Vapor
CWE-120
High · CVSS 7.5
EPSS 1.5%2022-06-06
High vulnerability · 2022-05-31
CWE-190
High · CVSS 7.5
EPSS 2.0%2022-05-31
LeafKit allows XSS with untrusted user input
CWE-79
High · CVSS 7.4
EPSS 0.7%2021-08-09
Critical vulnerability · 2021-07-09
CWE-502
Critical · CVSS 9.1
EPSS 1.2%2021-07-09
Medium vulnerability · 2021-02-26
CWE-400
Medium · CVSS 5.3
EPSS 1.6%2021-02-26
High vulnerability · 2020-10-02
CWE-22
High · CVSS 8.5
EPSS 1.5%2020-10-02

Track new Vapor CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Vapor CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

microsoft25,696 CVEs linux21,056 CVEs Google15,680 CVEs Apple14,957 CVEs Oracle11,815 CVEs Debian10,221 CVEs IBM8,381 CVEs Red Hat7,837 CVEs

Browse all vendors

Frequently asked questions

Common questions about Vapor vulnerabilities.

How many CVEs does Vapor have?: Vapor has 11 published CVE records since 2020, including 2 in the last two years.
How many Vapor CVEs are in CISA KEV?: None of Vapor's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Vapor products have the most CVEs?: The Vapor products with the most published CVEs are vapor, github.com/vapor/vapor, github.com/vapor/leaf-kit, leafkit, leaf-kit.
What are the most common weakness types in Vapor CVEs?: Vapor's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-190 (Integer Overflow or Wraparound), CWE-20 (Improper Input Validation), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).
Are there public exploits for Vapor vulnerabilities?: Yes — 4 of Vapor's CVEs have a known public exploit.
How many critical Vapor vulnerabilities are there?: Vapor has 1 critical and 4 high-severity CVEs.
What is the average severity of Vapor CVEs?: The average CVSS base score across Vapor's scored CVEs is 6.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Vapor vulnerabilities

Monitor new Vapor vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing