Read the docs

Panda3D

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

Panda3D records in CISA KEV

No Panda3D vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Cyrus Imap Server 4 records MEDIUM Panda3d 3 records MEDIUM Cveclient 2 records LOW Bootpd 1 record MEDIUM Carnegie Mellon Silicon Valley 1 record LOW Cyrus-sasl 1 record LOW Dbd 1 record MEDIUM Flite 1 record LOW

Records

2 records in Cveclient · all components

TI-2026-27597 CVE-2026-35467 · GHSA-3435-g6fx-jc4p

Private Key stored as extractable in browser IndexeDB

Priority LOW 38

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00236 Published 2026-04-02 Fixed in 1.1.15 CWE-522
TI-2026-27596 CVE-2026-35466 · GHSA-c5mh-66wj-fpf7

Stored XSS via unsanitized input from remote service

Priority LOW 27

XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00208 Published 2026-04-02 Fixed in 1.0.24 CWE-79
Open these records in search →