185 matches found
PT-2026-6447
Summary Description A Cross-site Scripting CWE-79 vulnerability in Qwik.js' server-side rendering virtual attribute serialization allows a remote attacker to inject arbitrary web scripts into server-rendered pages via virtual attributes. Successful exploitation permits script execution in a...
Qwik 跨站脚本漏洞
Qwik is a micro-web framework developed by Qwik Dev. Versions of Qwik prior to 1.19.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from server-side rendering of virtual property serialization, which allowed remote attackers to inject arbitrary web scripts...
Qwik 跨站请求伪造漏洞
Qwik is a micro-web framework developed by Qwik Dev. Versions of Qwik prior to 1.12.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from spelling errors in regular expressions, resulting in incorrect parsing of certain Content-Type headers...
PT-2026-6276
Name of the Vulnerable Software and Affected Versions Qwik versions prior to 1.19.0 Description Qwik City’s server-side request handler inconsistently interprets HTTP request headers. This can be exploited by a remote attacker to bypass Cross-Site Request Forgery CSRF protections on forms using...
Qwik 安全漏洞
Qwik is a micro-web framework developed by Qwik Dev. Versions of Qwik prior to 1.19.0 contained security vulnerabilities. These vulnerabilities stemmed from a prototype pollution vulnerability in the formToObj function, which could allow unauthenticated attackers to contaminate Object.prototype,...
PT-2026-6499
Summary A Prototype Pollution vulnerability exists in the formToObj function within @builder.io/qwik-city middleware. The function processes form field names with dot notation e.g., user.name to create nested objects, but fails to sanitize dangerous property names like proto , constructor, and...
Qwik 跨站请求伪造漏洞
Qwik is a micro-web framework developed by Qwik Dev. Versions of Qwik prior to 1.19.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from inconsistent interpretation of HTTP request headers by the server-side request processing logic, allowing remote attackers t...
@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), positron-components (>=1.12.2, <=1.12.3) potentially affected by CVE-2026-22803 via @sveltejs/kit (>=2.49.0, <=2.49.3)
@sveltejs/kit NPM version =2.49.0, =0.0.137, =1.12.2, =1.12.3 Source cves: CVE-2026-22803 Source advisory: OSV:GHSA-J2F3-WQ62-6Q46...
@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), positron-components (>=1.12.2, <=1.12.3) potentially affected by CVE-2026-22803 via @sveltejs/kit (>=2.49.0, <=2.49.3)
@sveltejs/kit NPM version =2.49.0, =0.0.137, =1.12.2, =1.12.3 Source cves: CVE-2026-22803 Source advisory: SNYK:JS-SVELTEJSKIT-14996726...
CVE-2024-41677
Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not including 1.6.0. Qwik improperly escapes HTML on server-side rendering. It converts strings according to the rules found in the render-ssr.ts file. It sometimes...
The vulnerability of the Qwik framework for creating high-performance web applications, related to a exception handling error that allows a hacker to cause a service failure.
The vulnerability of the Qwik framework for creating high-performance web applications is related to an exception handling error. Exploiting this vulnerability could allow a malicious actor to cause service failures...
EUVD-2004-1288
Malware in sbrugna...
EUVD-2023-1261
Malicious code in bioql PyPI...
EUVD-2024-2469
Malicious code in bioql PyPI...
EUVD-2025-20869
Malicious code in bioql PyPI...
EUVD-2023-0488
Malicious code in bioql PyPI...
EUVD-2023-0974
Malicious code in bioql PyPI...
CVE-2025-53620
@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in...
Denial Of Service (DoS)
@builder.io/qwik-city is vulnerable to Denial Of Service DoS. The vulnerability is due to the server not handling errors thrown when an invalid QRL function qfunc is sent, which allows an attacker to crash the Node.js server by triggering an unhandled exception...
CVE-2025-53620
@builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an invalid qfunc is sent, the server does not handle the thrown error. The error then causes Node JS to exit. This vulnerability is fixed in...