Browse CVEs

HIGH 7.5 CVE-2026-39844 NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can … Nicegui 3.10.0+ Fix from $1,9502026-04-08 HIGH 7.5 CVE-2026-33332 NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-c… Nicegui 3.9.0+ Fix from $1,9502026-03-24 MEDIUM 6.1 CVE-2026-27156 NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_metho… Nicegui 3.8.0+ Fix from $1,6002026-02-24 HIGH 7.5 CVE-2026-25732 NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitiza… Nicegui 3.7.0+ Fix from $1,9502026-02-06 MEDIUM 6.1 CVE-2026-25516 NiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then ren… Nicegui 3.7.0+ Fix from $1,6002026-02-06 MEDIUM 6.1 CVE-2026-21871 NiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled string… Nicegui 3.5.0+ Fix from $1,6002026-01-08 MEDIUM 6.1 CVE-2026-21872 NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the click event listener used by ui.sub_pages, com… Nicegui 3.5.0+ Fix from $1,6002026-01-08 MEDIUM 6.1 CVE-2026-21873 NiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages … Nicegui 3.5.0+ Fix from $1,6002026-01-08 MEDIUM 5.3 CVE-2026-21874 NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly openi… Nicegui 3.5.0+ Fix from $1,6002026-01-08 HIGH 7.5 CVE-2025-66645 NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, w… Nicegui 3.4.0+ Fix from $1,9502025-12-09 MEDIUM 6.1 CVE-2025-66470 NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of Nic… Nicegui 3.4.0+ Fix from $1,6002025-12-09 MEDIUM 6.1 CVE-2025-66469 NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass… Nicegui 3.4.0+ Fix from $1,6002025-12-09