VendorsZauberzeugniceguiany version
Vulnerabilities

Zauberzeug NiceGUI any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

12CVEs
CVE-2026-25732
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
Published 2026-02-06 · Analyzed
7.51 PoCEPSS 0.033
CVE-2025-66645
NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading
Published 2025-12-09 · Analyzed
7.5EPSS 0.011
CVE-2026-33332
NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
Published 2026-03-24 · Analyzed
7.5EPSS 0.006
CVE-2026-39844
NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization
Published 2026-04-08 · Analyzed
7.5EPSS 0.004
CVE-2026-21873
Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`
Published 2026-01-08 · Analyzed
7.2EPSS 0.003
CVE-2026-21871
NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
Published 2026-01-08 · Analyzed
6.1EPSS 0.003
CVE-2025-66469
NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
Published 2025-12-08 · Analyzed
6.1EPSS 0.003
CVE-2026-21872
NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
Published 2026-01-08 · Analyzed
6.1EPSS 0.003
CVE-2025-66470
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
Published 2025-12-09 · Analyzed
6.1EPSS 0.003
CVE-2026-25516
NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
Published 2026-02-06 · Analyzed
6.1EPSS 0.003
CVE-2026-27156
NiceGUI has XSS via Code Injection
Published 2026-02-24 · Analyzed
6.1EPSS 0.002
CVE-2026-21874
NiceGUI has Redis connection leak via tab storage causes service degradation
Published 2026-01-08 · Analyzed
5.3EPSS 0.006