QW
Vendor
Qwik
11
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-32701 | QW Qwik Qwik | 7.5 | Mar 20 | Qwik has array method pollution in FormData processing, allowing type confusion and DoS |
| CVE-2026-27971 | QW Qwik Qwik | 9.8 | Mar 3 | Qwik affected by unauthenticated RCE via server$ Deserialization |
| CVE-2026-25150 | QW Qwik Qwik | 10.0 | Feb 3 | Prototype Pollution via FormData Processing in Qwik City |
| CVE-2026-25148 | QW Qwik Qwik | 6.1 | Feb 3 | Qwik SSR XSS via Unsafe Virtual Node Serialization |
| CVE-2026-25151 | QW Qwik Qwik | 5.9 | Feb 3 | Qwik City has a CSRF Protection Bypass via Content-Type Header Validation |
| CVE-2026-25155 | QW Qwik Qwik | 7.1 | Feb 3 | [qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data) |
| CVE-2026-25149 | QW Qwik Qwik | 6.1 | Feb 3 | Qwik City Open Redirect via fixTrailingSlash |
| CVE-2024-41677 | QW Qwik Qwik | 6.1 | Aug 6 | Qwik is a performance focused javascript framework |
| CVE-2023-2307 | QW Qwik Qwik | 6.5 | Apr 26 | Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0 |
| CVE-2023-1283 | QW Qwik Qwik | 9.8 | Mar 8 | Code Injection in GitHub repository builderio/qwik prior to 0.21.0 |
| CVE-2023-0410 | QW Qwik Qwik | 6.1 | Jan 20 | Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5 |