QU
Vendor
@quasar
10
CVEs
0
On KEV
9
New 30D
Products
AP8.4
app-vite
@quasar
5 CVEs0 on KEV5 new
CL8.4
cli
@quasar
1 CVEs0 on KEV1 new
IC7.1
icongenie
@quasar
1 CVEs0 on KEV1 new
RE7.1
render-ssr-error
@quasar
1 CVEs0 on KEV1 new
SS8.4
ssl-certificate
@quasar
1 CVEs0 on KEV1 new
QM6.1
QMarkdown
Quasar
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-106108 | AP app-vite @quasar | 5.7 | Oct 13 | Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory |
| CVE-2026-106109 | AP app-vite @quasar | 4.1 | Oct 6 | Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories |
| CVE-2026-106107 | AP app-vite @quasar | 8.3 | Oct 6 | Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained |
| CVE-2026-106106 | AP app-vite @quasar | 7.1 | Oct 6 | Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable |
| CVE-2026-106105 | CL cli @quasar | 8.4 | Oct 6 | Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions |
| CVE-2026-106103 | IC icongenie @quasar | 7.1 | Oct 6 | Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile |
| CVE-2025-43954 | QM QMarkdown Quasar | 6.1 | Apr 20 | QMarkdown (aka quasar-ui-qmarkdown) before 2.0.5 allows XSS via headers even when when no-html is set |