CVE-2026-25155

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes incorrect parsing of certain Content-Type headers. This issue has been patched in version 1.12.0.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251566.3HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Co CVE-2026-251577.5OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in CVE-2026-25167.0A vulnerability was identified in Unidocs ezPDF DRM Reader and ezPDF Reader 2.0/3.0.0.4. This affects an unknown part in the library SHFOLDE CVE-2026-251607.4Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application disables CVE-2026-251618.8Alist is a file list program that supports multiple storages, powered by Gin and Solidjs. Prior to version 3.57.0, the application contains CVE-2026-251648.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST AP CVE-2026-251657.8Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally.CVE-2026-251667.8Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.CVE-2026-251677.4Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.CVE-2026-251685.5Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.CVE-2026-251695.5Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.CVE-2026-25177.5A security flaw has been discovered in Open5GS up to 2.7.6. This vulnerability affects the function ogs_gtp2_parse_tft in the library lib/gt