https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:03:52.796075+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274205 EUVD-2026-274205 2026-10-03T04:03:52.847960+00:00 EUVD-2026-274205 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27971 fkie_cve-2026-27971 2026-10-03T04:03:52.848000+00:00

Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.

 https://cve.radiocsirt.org/vuln/ghsa-p9x5-jp3h-96mm GHSA-p9x5-jp3h-96mm — Qwik vulnerable to Unauthenticated RCE via server$ Deserialization 2026-10-03T04:03:52.848035+00:00

Affected: npm: @builder.io/qwik

### Summary qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the `server$` RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where `require()` is available at runtime.

### Impact - Remote Code Execution