Medium
CVE-2026-45554
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 17
Reset filters
High
CVE-2026-45553
NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
Medium
CVE-2026-21872
NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
High
CVE-2026-21873
NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
Medium
CVE-2026-21871
NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
Medium
CVE-2026-21874
NiceGUI has Redis connection leak via tab storage causes service degradation
High
CVE-2025-66645
NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read
Medium
CVE-2025-66469
NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
Medium
CVE-2025-66470
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
Medium
CVE-2025-53354
NiceGUI has a Reflected XSS
High
CVE-2025-21618
NiceGUI On Air authentication issue
High
CVE-2024-32005
NiceGUI allows potential access to local file system
Medium
CVE-2026-39844
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
Medium
CVE-2026-33332
NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
Medium
CVE-2026-27156
NiceGUI vulnerable to XSS via Code Injection during client-side element function execution
Medium
CVE-2026-25516
NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
High
CVE-2026-25732
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.