Browse All CVEs
50,426 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-123575 |
high | 8.7 | 0.0041 | 2026-11-08 | Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTT | |
CVE-2026-123574 |
high | 8.7 | 0.0034 | 2026-11-08 | The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics | |
CVE-2026-123573 |
high | 8.7 | 0.0034 | 2026-11-08 | hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hi | |
CVE-2026-123572 |
high | 8.7 | 0.0034 | 2026-11-08 | Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hi | |
CVE-2026-123571 |
high | 8.7 | 0.0041 | 2026-11-08 | Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG | |
CVE-2026-123570 |
high | 8.7 | 0.0041 | 2026-11-08 | The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preal | |
CVE-2026-123569 |
high | 8.7 | 0.0034 | 2026-11-08 | The devalue package for npm before 5.6.3 can consume excessive CPU and memory when seriali | |
CVE-2026-123568 |
low | 2.1 | 0.0020 | 2026-11-08 | Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows att | |
CVE-2026-123567 |
medium | 6.3 | 0.0024 | 2026-11-08 | Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows att | |
CVE-2026-123566 |
high | 8.7 | 0.0034 | 2026-11-08 | Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attac | |
CVE-2026-123565 |
high | 8.7 | 0.0034 | 2026-11-08 | Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated | |
CVE-2026-123564 |
high | 8.7 | 0.0034 | 2026-11-08 | Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whos | |
CVE-2026-123563 |
high | 8.7 | 0.0037 | 2026-11-08 | Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBu | |
CVE-2026-123562 |
high | 8.7 | 0.0034 | 2026-11-08 | devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in s | |
CVE-2026-123561 |
medium | 6.3 | 0.0025 | 2026-11-08 | devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto | |
CVE-2026-123560 |
high | 8.7 | 0.0034 | 2026-11-08 | Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticate | |
CVE-2026-123559 |
high | 8.7 | 0.0034 | 2026-11-08 | Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allow | |
CVE-2026-123558 |
high | 8.7 | 0.0034 | 2026-11-08 | Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicio | |
CVE-2026-123557 |
high | 8.2 | 0.0031 | 2026-11-08 | ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition th | |
CVE-2026-123556 |
medium | 6.9 | 0.0030 | 2026-11-08 | ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that | |
CVE-2026-123555 |
high | 8.7 | 0.0043 | 2026-11-08 | Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unaut | |
CVE-2026-123554 |
high | 8.7 | 0.0043 | 2026-11-08 | Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity c | |
CVE-2026-123553 |
medium | 6.9 | 0.0025 | 2026-11-08 | OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, ws | |
CVE-2026-123552 |
medium | 6.3 | 0.0016 | 2026-11-08 | OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate C | |
CVE-2026-123551 |
critical | 10.0 | 0.0043 | 2026-11-08 | OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that all | |
CVE-2026-123550 |
critical | 9.3 | 0.0056 | 2026-11-08 | OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 serv | |
CVE-2026-123549 |
critical | 9.3 | 0.0035 | 2026-11-08 | OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-regis | |
CVE-2026-123548 |
low | 2.3 | 0.0020 | 2026-11-08 | OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation | |
CVE-2026-123547 |
low | 2.3 | 0.0018 | 2026-11-08 | OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redi | |
CVE-2026-123546 |
medium | 5.3 | 0.0022 | 2026-11-08 | OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that | |
CVE-2026-123545 |
high | 7.1 | 0.0012 | 2026-11-08 | OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in th | |
CVE-2026-123544 |
medium | 6.1 | 0.0030 | 2026-11-08 | OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the int | |
CVE-2026-123543 |
high | 8.7 | 0.0039 | 2026-11-08 | OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticate | |
CVE-2026-123542 |
high | 7.6 | 0.0025 | 2026-11-08 | OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, nev | |
CVE-2026-123541 |
medium | 5.3 | 0.0024 | 2026-11-08 | OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers | |
CVE-2026-123540 |
low | 2.0 | 0.0018 | 2026-11-08 | OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SA | |
CVE-2026-123539 |
medium | 4.8 | 0.0018 | 2026-11-08 | OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows priv | |
CVE-2026-123538 |
high | 7.5 | 0.0013 | 2026-11-08 | OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was sign | |
CVE-2026-123537 |
medium | 5.3 | 0.0020 | 2026-11-08 | OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows part | |
CVE-2026-123536 |
medium | 5.1 | 0.0023 | 2026-11-08 | OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows admi | |
CVE-2026-123535 |
low | 2.3 | 0.0017 | 2026-11-08 | Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (al | |
CVE-2026-123534 |
high | 8.3 | 0.0034 | 2026-11-08 | Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() | |
CVE-2026-123533 |
medium | 6.8 | 0.0011 | 2026-11-08 | gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of ser | |
CVE-2026-123532 |
high | 7.1 | 0.0058 | 2026-11-08 | gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allow | |
CVE-2026-123531 |
high | 8.7 | 0.0037 | 2026-11-08 | Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerabilit | |
CVE-2026-123530 |
medium | 6.0 | 0.0026 | 2026-11-08 | Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers | |
CVE-2026-123529 |
medium | 5.1 | 0.0015 | 2026-11-08 | Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticat | |
CVE-2026-123528 |
high | 7.6 | 0.0023 | 2026-11-08 | Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows | |
CVE-2026-123527 |
medium | 5.3 | 0.0024 | 2026-11-08 | Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows | |
CVE-2026-123526 |
medium | 5.3 | 0.0026 | 2026-11-08 | Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticate |