QW
Product
Qwik
11
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 3High 2Medium 6Low 0
Watch
Add Qwik to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25150 | 10.0 | Feb 3 | Prototype Pollution via FormData Processing in Qwik City Affected: before 1.19.0 |
| CVE-2026-27971 | 9.8 | Mar 3 | Qwik affected by unauthenticated RCE via server$ Deserialization Affected: before 1.19.1 |
| CVE-2023-1283 | 9.8 | Mar 8 | Code Injection in GitHub repository builderio/qwik prior to 0.21.0 Affected: before 0.21.0 |
| CVE-2026-32701 | 7.5 | Mar 20 | Qwik has array method pollution in FormData processing, allowing type confusion and DoS Affected: before 1.19.2 |
| CVE-2026-25155 | 7.1 | Feb 3 | [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data) Affected: before 1.12.0 |
| CVE-2023-2307 | 6.5 | Apr 26 | Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0 Affected: before 0.104.0 |
| CVE-2026-25148 | 6.1 | Feb 3 | Qwik SSR XSS via Unsafe Virtual Node Serialization Affected: before 1.19.0 |
| CVE-2026-25149 | 6.1 | Feb 3 | Qwik City Open Redirect via fixTrailingSlash Affected: before 1.19.0 |
| CVE-2024-41677 | 6.1 | Aug 6 | Qwik is a performance focused javascript framework Affected: before 1.7.3 |
| CVE-2023-0410 | 6.1 | Jan 20 | Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5 Affected: before 0.16.2 |
| CVE-2026-25151 | 5.9 | Feb 3 | Qwik City has a CSRF Protection Bypass via Content-Type Header Validation Affected: before 1.19.0 |
Showing 11