| CVE-2026-123529 | MEDIUM | 4.6 | Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with projec… | 2026-11-08 |
| CVE-2026-123530 | MEDIUM | 5.9 | Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen se… | 2026-11-08 |
| CVE-2026-123531 | HIGH | 8.8 | Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authen… | 2026-11-08 |
| CVE-2026-123532 | MEDIUM | 6.5 | gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers t… | 2026-11-08 |
| CVE-2026-123533 | MEDIUM | 5.5 | gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability b… | 2026-11-08 |
| CVE-2026-123534 | MEDIUM | 6.5 | Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() th… | 2026-11-08 |
| CVE-2026-123535 | MEDIUM | 4.2 | Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_sig… | 2026-11-08 |
| CVE-2026-123536 | MEDIUM | 4.1 | OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, includin… | 2026-11-08 |
| CVE-2026-123537 | MEDIUM | 5.0 | OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA … | 2026-11-08 |
| CVE-2026-123538 | MEDIUM | 6.6 | OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner na… | 2026-11-08 |
| CVE-2026-123539 | MEDIUM | 4.8 | OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to … | 2026-11-08 |
| CVE-2026-123540 | LOW | 2.0 | OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity prov… | 2026-11-08 |
| CVE-2026-123541 | MEDIUM | 4.7 | OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users af… | 2026-11-08 |
| CVE-2026-123542 | MEDIUM | 6.8 | OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the co… | 2026-11-08 |
| CVE-2026-123543 | HIGH | 7.5 | OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhau… | 2026-11-08 |
| CVE-2026-123544 | MEDIUM | 6.8 | OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-serv… | 2026-11-08 |
| CVE-2026-123545 | HIGH | 7.1 | OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device a… | 2026-11-08 |
| CVE-2026-123546 | MEDIUM | 6.1 | OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attac… | 2026-11-08 |
| CVE-2026-123547 | MEDIUM | 4.7 | OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to extern… | 2026-11-08 |
| CVE-2026-123548 | MEDIUM | 4.7 | OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 lo… | 2026-11-08 |
| CVE-2026-123549 | CRITICAL | 9.8 | OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing an… | 2026-11-08 |
| CVE-2026-123550 | CRITICAL | 9.8 | OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that ac… | 2026-11-08 |
| CVE-2026-123551 | CRITICAL | 10.0 | OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated … | 2026-11-08 |
| CVE-2026-123552 | MEDIUM | 6.5 | OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fet… | 2026-11-08 |
| CVE-2026-123553 | MEDIUM | 6.5 | OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityToke… | 2026-11-08 |
| CVE-2026-123554 | HIGH | 7.5 | Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transac… | 2026-11-08 |
| CVE-2026-123555 | HIGH | 7.5 | Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to … | 2026-11-08 |
| CVE-2026-123556 | MEDIUM | 5.3 | ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers b… | 2026-11-08 |
| CVE-2026-123557 | MEDIUM | 5.9 | ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenti… | 2026-11-08 |
| CVE-2026-123558 | HIGH | 7.5 | Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall che… | 2026-11-08 |
| CVE-2026-123559 | HIGH | 7.5 | Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated pe… | 2026-11-08 |
| CVE-2026-123560 | HIGH | 7.5 | Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall ini… | 2026-11-08 |
| CVE-2026-123561 | LOW | 3.7 | devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through… | 2026-11-08 |
| CVE-2026-123562 | HIGH | 7.5 | devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when … | 2026-11-08 |
| CVE-2026-123563 | HIGH | 7.5 | Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to ski… | 2026-11-08 |
| CVE-2026-123564 | HIGH | 7.5 | Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for… | 2026-11-08 |
| CVE-2026-123565 | HIGH | 7.5 | Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings ca… | 2026-11-08 |
| CVE-2026-123566 | HIGH | 7.5 | Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU am… | 2026-11-08 |
| CVE-2026-123567 | LOW | 3.7 | Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __p… | 2026-11-08 |
| CVE-2026-123568 | MEDIUM | 4.4 | Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter obje… | 2026-11-08 |
| CVE-2026-123569 | HIGH | 7.5 | The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays w… | 2026-11-08 |
| CVE-2026-123570 | HIGH | 7.5 | The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vecto… | 2026-11-08 |
| CVE-2026-123571 | HIGH | 7.5 | Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that … | 2026-11-08 |
| CVE-2026-123572 | HIGH | 7.5 | Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and… | 2026-11-08 |
| CVE-2026-123573 | HIGH | 7.5 | hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and… | 2026-11-08 |
| CVE-2026-123574 | HIGH | 7.5 | The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token… | 2026-11-08 |
| CVE-2026-123575 | HIGH | 7.5 | Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server tha… | 2026-11-08 |
| CVE-2026-123576 | HIGH | 7.5 | Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to c… | 2026-11-08 |
| CVE-2026-123577 | HIGH | 7.5 | Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attacker… | 2026-11-08 |
| CVE-2026-123578 | LOW | 3.7 | Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP… | 2026-11-08 |