Search vulnerabilities

Expected end of text, found ':' (at char 22), (line:1, col:23)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,857

CVE-2026-123615

imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader

imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header reconstruction (vips_foreign_load_ico_header in vips/icoload.c) when an ICO entry declares a tiny data size, causing unvalidated header fields to be read and written past the allocated buffer. Unauthenticated remote attackers can supply a crafted ICO image to corrupt adjacent heap chunk metadata, triggering a glibc abort that crashes the worker.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Evilmartians
Products
Imgproxy
CVE-2026-123612

rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure

rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server when Encrypted Client Hello is rejected. Because start_traffic() queues plaintext from ClientConnection::writer() before sending the ech_required alert, the authenticated public_name server receives data intended for the inner server.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Rustls Project
Products
Rustls
CVE-2026-123568

Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs from the original input.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Svelte
Products
Devalue
CVE-2026-123567

Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Svelte
Products
Devalue
CVE-2026-123564

Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays

Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust memory in the browser or runtime evaluating the output.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Svelte
Products
Devalue
CVE-2026-123563

Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse

Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing memory exhaustion and denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Svelte
Products
Devalue
CVE-2026-123560

Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zfnd
Products
Zebra
CVE-2026-123559

Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Zfnd
Products
Zebra
CVE-2026-123556

Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring

ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current height right after each block, causing lagging nodes to ban honest relaying peers for 24 hours or until restart.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zfnd
Products
Zebra
CVE-2026-123552

OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point

OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a trusted-CA-chained certificate can make OpenAM request internal hosts, capture configured CRL update credentials, overwrite stored revocation data to block certificate authentication for that CA, and tie up authentication threads.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123551

OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123549

OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass

OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123548

OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages

OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123547

OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState

OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123544

OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123543

OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation

OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation and policy decisions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123540

OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST

OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute names or values that reach the target application in modified form, undermining the integrity of received attributes.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123539

OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name

OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name executes script that can steal the OpenAM session cookie to impersonate the user.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123536

OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs

OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2026-123535

Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age

Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Tornadoweb
Products
Tornado