CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 03/02/2026 |
| CVE-2026-25151 | MOYENNE5.9 | Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interprets HTTP request headers, which can be abused by a remote attacker to circumvent form submission CSRF protections using specially crafted or multi-valued Content-Type headers. This | 03/02/2026 |
| CVE-2026-25150 | CRITIQUE10.0 | Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() function within @builder.io/qwik-city middleware. The function processes form field names with dot notation (e.g., user.name) to create nested objects, but fails to sanitize dangero | 03/02/2026 |
| CVE-2026-25149 | MOYENNE6.1 | Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request handler middleware allows a remote attacker to redirect users to arbitrary protocol-relative URLs. Successful exploitation permits attackers to craft convincing phishing links that | 03/02/2026 |
| CVE-2026-25148 | MOYENNE6.1 | Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits | 03/02/2026 |
| CVE-2024-41677 | MOYENNE6.1 | Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the `render-ssr.ts` file. It sometimes causes the situation tha | 06/08/2024 |
| CVE-2023-2307 | MOYENNE6.5 | Cross-Site Request Forgery (CSRF) in GitHub repository builderio/qwik prior to 0.104.0.
| 26/04/2023 |
| CVE-2023-1283 | CRITIQUE9.8 | Code Injection in GitHub repository builderio/qwik prior to 0.21.0.
| 08/03/2023 |
| CVE-2023-0410 | MOYENNE6.1 | Cross-site Scripting (XSS) - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5. | 20/01/2023 |