Login Request a demo
QW
Product
qwik
by QwikDev · last CVE Oct 13, 2026
10
CVEs
0
On KEV
10.0
Max CVSS
1
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 3High 3Medium 4Low 0
Severity
All severities10Critical3High3Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add qwik to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-25150
10.0
1%
Feb 3
Prototype Pollution via FormData Processing in Qwik City
Affected: < 1.19.0
CVE-2026-27971
9.8
6%
Mar 3
Qwik affected by unauthenticated RCE via server$ Deserialization
Affected: < 1.19.1
CVE-2025-53620
9.2
0%
Jul 9
Crashing any Qwik Server
Affected: < 1.13.0
CVE-2026-84994
8.7
1%
Oct 13
Qwik: Crashing any Qwik Server via Resource thenable
Affected: < 2.0.0-beta37
CVE-2026-32701
7.5
0%
Mar 20
Qwik has array method pollution in FormData processing, allowing type confusion and DoS
Affected: < 1.19.2
CVE-2026-25155
7.1
0%
Feb 3
[qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)
Affected: < 1.12.0
CVE-2026-25148
6.1
0%
Feb 3
Qwik SSR XSS via Unsafe Virtual Node Serialization
Affected: < 1.19.0
CVE-2026-25149
6.1
0%
Feb 3
Qwik City Open Redirect via fixTrailingSlash
Affected: < 1.19.0
CVE-2024-41677
6.1
0%
Aug 6
Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik
Affected: @builder.io/qwik: < 1.7.3; qwik: < 1.6.0
CVE-2026-25151
5.9
0%
Feb 3
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation
Affected: < 1.19.0
Showing 10