Q
Vendor security profile
quasarframework
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical1
CISA KEV0
Public exploit4
Patch rate%11
Avg. CVSS6.9
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
1
0
8
CVE KEV
CVE severity distribution
9toplam CVE
Critical1 (11%)
High5 (56%)
Medium2 (22%)
Low1 (11%)
Patch and exploitation view
%11
Verified patch
%0
CISA KEV
%44
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
8Unknown
Latest vulnerabilities
4.1
CVE-2026-106109
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories
Q
Patch status unknownEPSS %0
8.3
CVE-2026-106107
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
Q
Patch status unknownEPSS %0
7.1
CVE-2026-106106
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
Q
Patch status unknownEPSS %0
8.4
CVE-2026-106105
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
Q
Patch status unknownEPSS %0
8.7
CVE-2026-106104
Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server
Q
Patch status unknownEPSS %0
7.1
CVE-2026-106103
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile
Q
Patch status unknownEPSS %0
10.0
CVE-2026-106102
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
Q
Patch status unknownEPSS %0
3.1
CVE-2026-106101
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
Q
Patch status unknownEPSS %0
5.6
CVE-2026-73647
Quasar Framework: Prototype pollution in Quasar extend() utility
Q
Patch verifiedEPSS %0