https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T16:56:06.413997+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-267334 EUVD-2026-267334 2026-10-06T16:56:06.463270+00:00 EUVD-2026-267334 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25155 fkie_cve-2026-25155 2026-10-06T16:56:06.463308+00:00

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

 https://cve.radiocsirt.org/vuln/ghsa-vm6g-8r4h-22x8 GHSA-vm6g-8r4h-22x8 — Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form… 2026-10-06T16:56:06.463341+00:00

Affected: npm: @builder.io/qwik-city

### Summary A typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers.

### Impact An attacker can bypass Qwik City’s Origin-based CSRF protections and perform forged form submissions, potentially causing unauthorized state changes.