CVEs
Browse the synced catalog, newest first.
- CVE-2026-123557Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer DisconnectionZcashFoundation zebra
- CVE-2026-123556Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time ScoringZcashFoundation zebra
- CVE-2026-123555Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification FailuresZcashFoundation zebra
- CVE-2026-123554Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity CheckZcashFoundation zebra
- CVE-2026-123553OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated LoginOpenIdentityPlatform OpenAM
- CVE-2026-123552OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution PointOpenIdentityPlatform OpenAM
- CVE-2026-123551OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocketOpenIdentityPlatform OpenAM
- CVE-2026-123550OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned AssertionsOpenIdentityPlatform OpenAM
- CVE-2026-123549OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute BypassOpenIdentityPlatform OpenAM
- CVE-2026-123548OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 PagesOpenIdentityPlatform OpenAM
- CVE-2026-123547OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayStateOpenIdentityPlatform OpenAM
- CVE-2026-123546OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFailOpenIdentityPlatform OpenAM
- CVE-2026-123545OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device FlowOpenIdentityPlatform OpenAM
- CVE-2026-123544OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP ChannelOpenIdentityPlatform OpenAM
- CVE-2026-123543OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java DeserialisationOpenIdentityPlatform OpenAM
- CVE-2026-123542OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization FlowOpenIdentityPlatform OpenAM
- CVE-2026-123541OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner MatchingOpenIdentityPlatform OpenAM
- CVE-2026-123540OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POSTOpenIdentityPlatform OpenAM
- CVE-2026-123539OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display NameOpenIdentityPlatform OpenAM
- CVE-2026-123538OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer ImpersonationOpenIdentityPlatform OpenAM
- CVE-2026-123537OpenAM before 16.1.4 SSRF via UMA Scope Description URLsOpenIdentityPlatform OpenAM
- CVE-2026-123536OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLsOpenIdentityPlatform OpenAM
- CVE-2026-123535Tornado before 6.6 Cookie Attribute Injection via set_cookie max_agetornadoweb tornado
- CVE-2026-123534Tornado before 6.6 Path Traversal via static_url() Version Hashingtornadoweb tornado
- CVE-2026-123533Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph FileGitoxideLabs gitoxide
- CVE-2026-123532gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC ProbeGitoxideLabs gitoxide
- CVE-2026-123531Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parametergo-vikunja vikunja
- CVE-2026-123530Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpointsgo-vikunja vikunja
- CVE-2026-123529Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-colorgo-vikunja vikunja
- CVE-2026-123528Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middlewarego-vikunja vikunja