CVE WatchOct 6, 2026

CVE-2026-106105

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.

CVSS

—

No CVSS

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Oct 6, 2026 · Last modified: Oct 6, 2026 · CWE-732

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-10-072026-10-21

Technical description

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name. This issue is fixed in @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1141056.2 MED

1.0%

——0Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on extracted files when keepOriginalPermission is enabled. Attackers can craft zip external file attributes that pass unmasked into chmod, letting attacker-controlled executables gain elevated privileges when extracted as root and later run.1d CVE-2026-113720—

1.0%

——0virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the app-data copy seeder uses shutil.copy() to copy cached package files into later environments, causing cached source modes to override the current run's umask. A cache populated under a permissive umask can therefore produce files writable by another local account in a later traversable environment, allowing package code such as pip/__init__.py to be modified and executed by the environment owner. The attacker cannot force the earlier umask, and a private destination parent prevents access. This issue is fixed in version 21.14.9.2d CVE-2026-711697.0 HIG

1.4%

——0Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Disclosure of sensitive information2d CVE-2026-965425.0 MED

0.2%

——0Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam. This issue is corrected in version 1.0.14940699 and later; service permissions automatically self-heal upon launching an integrated EA game title.3d CVE-2026-964255.5 MED

1.0%

——0Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus4d CVE-2026-964247.8 HIG

1.0%

——0Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus4d