openadapt (0.7.1) potentially affected by CVE-2025-21618 via nicegui (1.2.16)

nicegui PYPI version 1.2.16 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openadapt 0.7.1 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

rosys (>=0.8.4, <=0.8.5) potentially affected by CVE-2025-21618 via nicegui (1.2.17)

nicegui PYPI version 1.2.17 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.8.4, =0.8.5 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

openadapt (>=0.8.0, <=0.8.1) potentially affected by CVE-2025-21618 via nicegui (1.2.24)

nicegui PYPI version 1.2.24 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openadapt =0.8.0, =0.8.1 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

nice-gui-utils (>=0.1.2.dev0, <=0.1.2.dev3) potentially affected by CVE-2025-21618 via nicegui (1.4.1)

nicegui PYPI version 1.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils =0.1.2.dev0, =0.1.2.dev3 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

nice-gui-utils (>=0.1.2, <=0.1.5) potentially affected by CVE-2025-21618 via nicegui (1.4.2)

nicegui PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils =0.1.2, =0.1.5 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

nice-gui-utils (0.1.6) potentially affected by CVE-2025-21618 via nicegui (1.4.3)

nicegui PYPI version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - nice-gui-utils 0.1.6 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

forta-gate (0.1.0), openadapt (>=0.9.0, <=0.16.2) potentially affected by CVE-2025-21618 via nicegui (1.4.7)

nicegui PYPI version 1.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - forta-gate 0.1.0 - openadapt =0.9.0, =0.16.2 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

openadapt (>=0.17.0, <=0.26.2) potentially affected by CVE-2025-21618 via nicegui (1.4.9)

nicegui PYPI version 1.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openadapt =0.17.0, =0.26.2 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

openorchestrator (>=1.1.0, <=1.3.1) potentially affected by CVE-2025-21618 via nicegui (1.4.12)

nicegui PYPI version 1.4.12 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openorchestrator =1.1.0, =1.3.1 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

kayalab (>=0.1.0, <=0.7.29) potentially affected by CVE-2025-21618 via nicegui (1.4.13)

nicegui PYPI version 1.4.13 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - kayalab =0.1.0, =0.7.29 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

kayalab (>=0.7.30, <=0.11.9) potentially affected by CVE-2025-21618 via nicegui (1.4.24)

nicegui PYPI version 1.4.24 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - kayalab =0.7.30, =0.11.9 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

finalynx (>=1.2.0, <=1.14.4) potentially affected by CVE-2025-21618 via nicegui (1.4.25)

nicegui PYPI version 1.4.25 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - finalynx =1.2.0, =1.14.4 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

synth-mapping-helper (1.4.7) potentially affected by CVE-2025-21618 via nicegui (1.4.30)

nicegui PYPI version 1.4.30 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.4.7 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

synth-mapping-helper (>=1.4.8, <=1.5.0) potentially affected by CVE-2025-21618 via nicegui (1.4.36)

nicegui PYPI version 1.4.36 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.4.8, =1.5.0 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

air-link (>=0.0.0, <=0.2.1), broh5 (1.3.2) +16 more potentially affected by CVE-2025-21618 via nicegui (1.4.37)

nicegui PYPI version 1.4.37 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - air-link =0.0.0, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.14.5, =0.0.2a5, =1.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves:...

synth-mapping-helper (>=1.5.1, <=1.5.9) potentially affected by CVE-2025-21618 via nicegui (>=2.3.0, <=2.8.1)

nicegui PYPI version =2.3.0, =1.5.1, =1.5.9 Source cves: CVE-2025-21618 Source advisory: OSV:PYSEC-2026-1705...

PYSEC-2026-1705 NiceGUI On Air authentication issue

Summary Once a user logins to one browser, all other browsers are logged in without entering password. Even incognito mode. Impact high...

forta-gate (0.1.0), kayalab (>=0.1.0, <=0.7.29) +2 more potentially affected by CVE-2024-32005 via nicegui (>=1.4.7, <=1.4.13)

nicegui PYPI version =1.4.7, =0.1.0, =0.9.0, =1.1.0, =1.3.1 Source cves: CVE-2024-32005 Source advisory: OSV:PYSEC-2026-1704...

PYSEC-2026-1704 NiceGUI allows potential access to local file system

NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the /nicegui/version/resources/key/path:path route. As a result any file on the backend filesystem which the web server has access to can be...

CVE-2026-45554

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside...