Zauberzeug vulnerabilities

Products

• Nicegui 17

Newest

• zauberzeug nicegui NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes CVE-2026-45554 Fix available 5.3 MediumMay 18, 2026
• zauberzeug nicegui NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text() CVE-2026-45553 Fix available 7.5 HighMay 18, 2026
• zauberzeug nicegui NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization CVE-2026-39844 Fix available 5.9 MediumApril 8, 2026
• zauberzeug nicegui NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion CVE-2026-33332 Fix available 6.9 MediumMarch 19, 2026
• zauberzeug nicegui NiceGUI has XSS via Code Injection CVE-2026-27156 Fix available 6.1 MediumFebruary 24, 2026
• zauberzeug nicegui NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write CVE-2026-25732 Public exploitFix available 7.5 HighFebruary 5, 2026
• zauberzeug nicegui NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content CVE-2026-25516 Fix available 6.1 MediumFebruary 5, 2026
• zauberzeug nicegui NiceGUI has Redis connection leak via tab storage causes service degradation CVE-2026-21874 Fix available 5.3 MediumJanuary 8, 2026
• zauberzeug nicegui Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages` CVE-2026-21873 Fix available 7.2 HighJanuary 8, 2026
• zauberzeug nicegui NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links CVE-2026-21872 Fix available 6.1 MediumJanuary 8, 2026
• zauberzeug nicegui NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace() CVE-2026-21871 Fix available 6.1 MediumJanuary 8, 2026
• zauberzeug nicegui NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading CVE-2025-66645 Public exploitFix available 7.5 HighDecember 9, 2025
• zauberzeug nicegui NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content CVE-2025-66470 Public exploitFix available 6.1 MediumDecember 8, 2025
• zauberzeug nicegui NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection CVE-2025-66469 Fix available 6.1 MediumDecember 8, 2025
• zauberzeug nicegui NiceGUI is vulnerable to Reflected XSS attack CVE-2025-53354 Fix available 6.1 MediumOctober 3, 2025
• zauberzeug nicegui NiceGUI On Air authentication issue CVE-2025-21618 Fix available 7.5 HighJanuary 6, 2025
• zauberzeug nicegui Local File Inclusion in NiceGUI leaflet component CVE-2024-32005 Fix available 8.2 HighApril 12, 2024