CVEs
Common Vulnerabilities & Exposures ingested from CVE Project cvelistV5, NVD and EUVD. Filter by year or search by ID / title.
252033 CVEs matched. Showing 51–100 (page 2 of 5041).
HIGH and CRITICAL CVEs are auto-promoted to the Threats table; the Threat column below shows the link when a promotion exists.
Click a column header to sort all results; click the active column again to reverse.
| CVE-ID ↕ | Title ↕ | Severity ↕ | Score (overview) ↕ | NVD Score | MSRC Score | CNA ↕ | Published ↕ | Remediations | Threat | Source |
|---|---|---|---|---|---|---|---|---|---|---|
CVE-2026-123567 |
Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten | MEDIUM | 6.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123566 |
Devalue before 5.9.3 CPU Amplification Denial of Service via uneval | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123565 |
Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123564 |
Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123563 |
Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123562 |
Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123561 |
Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion | MEDIUM | 6.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123560 |
Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123559 |
Zebra before 7.0.0 Denial of Service via Quadratic Sighash Computation | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123558 |
Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123557 |
Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection | HIGH | 8.2 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123556 |
Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123555 |
Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123554 |
Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123553 |
OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123552 |
OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point | MEDIUM | 6.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123551 |
OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket | CRITICAL | 10.0 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123550 |
OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions | CRITICAL | 9.3 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123549 |
OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass | CRITICAL | 9.3 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123548 |
OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages | LOW | 2.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123547 |
OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState | LOW | 2.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123546 |
OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123545 |
OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow | HIGH | 7.1 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123544 |
OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel | MEDIUM | 6.1 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123543 |
OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123542 |
OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow | HIGH | 7.6 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123541 |
OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123540 |
OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST | LOW | 2.0 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123539 |
OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name | MEDIUM | 4.8 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123538 |
OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation | HIGH | 7.5 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123537 |
OpenAM before 16.1.4 SSRF via UMA Scope Description URLs | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123536 |
OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs | MEDIUM | 5.1 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123535 |
Tornado before 6.6 Cookie Attribute Injection via set_cookie max_age | LOW | 2.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123534 |
Tornado before 6.6 Path Traversal via static_url() Version Hashing | HIGH | 8.3 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123533 |
Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph File | MEDIUM | 6.8 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123532 |
gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC Probe | HIGH | 7.1 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123531 |
Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter | HIGH | 8.7 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123530 |
Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints | MEDIUM | 6.0 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123529 |
Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color | MEDIUM | 5.1 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123528 |
Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware | HIGH | 7.6 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123527 |
Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | 10 | — | raw · ⬇ |
CVE-2026-123526 |
Vikunja before 2.7.1 Mass Assignment via Team external_id Field | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | — | — | raw · ⬇ |
CVE-2026-123525 |
Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations | HIGH | 7.1 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123524 |
Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload | MEDIUM | 6.9 | — | — | VulnCheck | 2026-11-08 | — | — | raw · ⬇ |
CVE-2026-123523 |
Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache | HIGH | 7.1 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123522 |
Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook | HIGH | 7.1 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123521 |
Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint | MEDIUM | 6.0 | — | — | VulnCheck | 2026-11-08 | — | — | raw · ⬇ |
CVE-2026-123520 |
Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion | HIGH | 7.1 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123519 |
Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports | HIGH | 7.1 | — | — | VulnCheck | 2026-11-08 | 10 | ⚠ Threat | raw · ⬇ |
CVE-2026-123518 |
Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move | MEDIUM | 5.3 | — | — | VulnCheck | 2026-11-08 | — | — | raw · ⬇ |