CVE-2026-123563

Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse

Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing memory exhaustion and denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Svelte

Products

Devalue

CVE-2026-123560

Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Zfnd

Products

Zebra

CVE-2026-123559

Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Zfnd

Products

Zebra

CVE-2026-123556

Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring

ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. Attackers can broadcast transactions locked until the current height right after each block, causing lagging nodes to ban honest relaying peers for 24 hours or until restart.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zfnd

Products

Zebra

CVE-2026-123552

OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point

OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a trusted-CA-chained certificate can make OpenAM request internal hosts, capture configured CRL update credentials, overwrite stored revocation data to block certificate authentication for that CA, and tie up authentication threads.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-123551

OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-123549

OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass

OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or User Self-Service flow to join administrative groups and gain full administrative control of OpenAM.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-123548

OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages

OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provider finder, and some authentication pages do not check destination URLs against allowed lists. Attackers can craft OpenAM-domain links that send users to arbitrary external sites for phishing.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-123547

OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState

OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-123544

OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel

OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-123543

OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation

OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation and policy decisions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-123540

OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST

OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute names or values that reach the target application in modified form, undermining the integrity of received attributes.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-123539

OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name

OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name executes script that can steal the OpenAM session cookie to impersonate the user.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-123536

OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs

OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-123535

Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age

Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Tornadoweb

Products

Tornado

CVE-2026-123532

gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC Probe

gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gitoxidelabs

Products

Gitoxide

CVE-2026-123531

Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter

Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-123528

Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-123527

Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass

Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-123523

Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account without eviction and causing the API process to be OOM-killed.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja