QU
Vendor
quasarframework
10
CVEs
0
On KEV
9
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-106108 | QU quasar quasarframework | 5.7 | Oct 13 | Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory |
| CVE-2026-106109 | QU quasar quasarframework | 4.1 | Oct 6 | Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories |
| CVE-2026-106107 | QU quasar quasarframework | 8.3 | Oct 6 | Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained |
| CVE-2026-106106 | QU quasar quasarframework | 7.1 | Oct 6 | Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable |
| CVE-2026-106105 | QU quasar quasarframework | 8.4 | Oct 6 | Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions |
| CVE-2026-106104 | QU quasar quasarframework | 8.7 | Oct 6 | Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server |
| CVE-2026-106103 | QU quasar quasarframework | 7.1 | Oct 6 | Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile |
| CVE-2026-106102 | QU quasar quasarframework | 10.0 | Oct 6 | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() |
| CVE-2026-106101 | QU quasar quasarframework | 3.1 | Oct 6 | Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service |
| CVE-2026-73647 | QU quasar quasarframework | 5.6 | Aug 13 | Quasar Framework: Prototype pollution in Quasar extend() utility |