Known CVE

Qwik - Unauthenticated RCE via server$ Deserialization

Qwik <=1.19.0 contains an insecure deserialization vulnerability in the server$ RPC mechanism, letting unauthenticated attackers execute arbitrary code remotely, exploit requires require() availability at runtime.

CVE-2026-27971

Critical2026CVSS 9.2CWE-502

cve2026 · qwik · rce · deserialization · vkev

Verified scans run this check after you prove you own the site.

All known CVEs View the checks catalog National Vulnerability Database

Scan a website