What’s Vulnerable › Products
zauberzeug nicegui vulnerabilities
17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.
Check whether your zauberzeug nicegui version is affected
Latest zauberzeug nicegui vulnerabilities
- CVE-2026-45554 — NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes (CVSS 5.3)
- CVE-2026-45553 — NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text() (CVSS 7.5)
- CVE-2026-39844 — NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization (CVSS 7.5)
- CVE-2026-33332 — NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion (CVSS 7.5)
- CVE-2026-27156 — NiceGUI has XSS via Code Injection (CVSS 6.1)
- CVE-2026-25732 — NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write (CVSS 7.5)
- CVE-2026-25516 — NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content (CVSS 6.1)
- CVE-2026-21874 — NiceGUI has Redis connection leak via tab storage causes service degradation (CVSS 5.3)
- CVE-2026-21873 — Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages` (CVSS 6.1)
- CVE-2026-21872 — NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links (CVSS 6.1)
- CVE-2026-21871 — NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace() (CVSS 6.1)
- CVE-2025-66645 — NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading (CVSS 7.5)
- CVE-2025-66470 — NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content (CVSS 6.1)
- CVE-2025-66469 — NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection (CVSS 6.1)
- CVE-2025-53354 — NiceGUI is vulnerable to Reflected XSS attack (CVSS 6.1)
- CVE-2025-21618 — NiceGUI On Air authentication issue (CVSS 7.5)
- CVE-2024-32005 — Local File Inclusion in NiceGUI leaflet component (CVSS 8.2)