Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 251–275 of 320
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-123562 | HIGH | Patched | 7.5 | 2026-11-08 | devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting befor… |
| CVE-2026-123561 | MEDIUM | Patched | 3.7 | 2026-11-08 | devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-f… |
| CVE-2026-123560 | HIGH | Patched | 7.5 | 2026-11-08 | Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers… |
| CVE-2026-123559 | HIGH | Patched | 7.5 | 2026-11-08 | Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions… |
| CVE-2026-123558 | HIGH | Patched | 7.5 | 2026-11-08 | Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed … |
| CVE-2026-123557 | HIGH | Patched | 5.9 | 2026-11-08 | ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnecti… |
| CVE-2026-123556 | MEDIUM | Patched | 5.3 | 2026-11-08 | ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring mempool lock-time rejections at the ban threshold. A… |
| CVE-2026-123555 | HIGH | Patched | 7.5 | 2026-11-08 | Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade misbehavior scoring by sending transactions or blocks wi… |
| CVE-2026-123554 | HIGH | Patched | 7.5 | 2026-11-08 | Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbase_spend_restriction() rebuilds the transaction's … |
| CVE-2026-123553 | MEDIUM | Patched | 6.5 | 2026-11-08 | OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth) with passwords that are identical on e… |
| CVE-2026-123552 | MEDIUM | Patched | 6.5 | 2026-11-08 | OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented cer… |
| CVE-2026-123551 | CRITICAL | Patched | 10.0 | 2026-11-08 | OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification We… |
| CVE-2026-123550 | CRITICAL | Patched | 9.8 | 2026-11-08 | OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact … |
| CVE-2026-123549 | CRITICAL | Patched | 9.8 | 2026-11-08 | OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group… |
| CVE-2026-123548 | LOW | Patched | 4.7 | 2026-11-08 | OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provid… |
| CVE-2026-123547 | LOW | Patched | 4.7 | 2026-11-08 | OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrl… |
| CVE-2026-123546 | MEDIUM | Patched | 6.1 | 2026-11-08 | OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the got… |
| CVE-2026-123545 | HIGH | Patched | 7.1 | 2026-11-08 | OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device code… |
| CVE-2026-123544 | MEDIUM | Patched | 6.8 | 2026-11-08 | OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affe… |
| CVE-2026-123543 | HIGH | Patched | 7.5 | 2026-11-08 | OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without si… |
| CVE-2026-123542 | HIGH | Patched | 6.8 | 2026-11-08 | OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attack… |
| CVE-2026-123541 | MEDIUM | Patched | 4.7 | 2026-11-08 | OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partne… |
| CVE-2026-123540 | LOW | Patched | 2.0 | 2026-11-08 | OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content … |
| CVE-2026-123539 | MEDIUM | Patched | 4.8 | 2026-11-08 | OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When… |
| CVE-2026-123538 | HIGH | Patched | 6.6 | 2026-11-08 | OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate … |