Login Request a demo
QW
Product
qwik
by QwikDev · last CVE Oct 13, 2026
8
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 2High 3Medium 3Low 0
Severity
All severities8Critical2High3Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add qwik to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-25150
10.0
1%
Feb 3
Prototype Pollution via FormData Processing in Qwik City
Affected: < 1.19.0
CVE-2026-27971
9.8
6%
Mar 3
Qwik affected by unauthenticated RCE via server$ Deserialization
Affected: < 1.19.1
CVE-2026-84994
8.7
1%
Oct 13
Qwik: Crashing any Qwik Server via Resource thenable
Affected: < 2.0.0-beta37
CVE-2026-32701
7.5
0%
Mar 20
Qwik has array method pollution in FormData processing, allowing type confusion and DoS
Affected: < 1.19.2
CVE-2026-25155
7.1
0%
Feb 3
[qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)
Affected: < 1.12.0
CVE-2026-25148
6.1
0%
Feb 3
Qwik SSR XSS via Unsafe Virtual Node Serialization
Affected: < 1.19.0
CVE-2026-25149
6.1
0%
Feb 3
Qwik City Open Redirect via fixTrailingSlash
Affected: < 1.19.0
CVE-2026-25151
5.9
0%
Feb 3
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation
Affected: < 1.19.0
Showing 8