zauberzeug vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20255
3. 202611

Newest CVEs

• CVE-2026-45554

  NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes

  zauberzeug · nicegui

  Medium5.3
• CVE-2026-45553

  NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

  zauberzeug · nicegui

  High7.5
• CVE-2026-39844

  NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization

  zauberzeug · nicegui

  Medium5.9
• CVE-2026-33332

  NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

  zauberzeug · nicegui

  Medium6.9
• CVE-2026-27156

  NiceGUI has XSS via Code Injection

  zauberzeug · nicegui

  Medium6.1
• CVE-2026-25516

  NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

  zauberzeug · nicegui

  Medium6.1
• CVE-2026-25732

  NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write

  zauberzeug · nicegui

  High7.5
• CVE-2026-21874

  NiceGUI has Redis connection leak via tab storage causes service degradation

  zauberzeug · nicegui

  Medium5.3
• CVE-2026-21873

  Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`

  zauberzeug · nicegui

  High7.2
• CVE-2026-21872

  NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links

  zauberzeug · nicegui

  Medium6.1