vapor leaf-kit

• CVE-2026-28499 Medium 6.9 LeafKit's HTML escaping may be skipped for Collection values, enabling XSS 0.3%
• CVE-2026-27120 Medium 6.1 Leaf-kit html escaping does not work on characters that are part of extended grapheme cluster 0.3%
• CVE-2021-37634 High 7.4 LeafKit allows XSS with untrusted user input 0.7%