CVEs published in November 2026
7,952 vulnerabilities, 679 critical, 12 exploited.
- hickory-dnsHickory DNS 0.26.0-beta.1 before 0.26.2 Improper NSEC/NSEC3 Signature Validation6.3 Medium
- hickory-dnsHickory DNS before 0.26.2 Denial of Service via Missing DNS-over-QUIC Request Read Timeout6.9 Medium
- hickory-dnsHickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Pool8.7 High
- hickory-dnsHickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responses6.3 Medium
- hickory-dnsHickory DNS 0.25.0 before 0.26.2 DNSSEC Validation Bypass via SOA Record6.3 Medium
- hickory-dnsHickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Wildcard Expansion6.3 Medium
- hickory-dnsHickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=06.3 Medium
- hickory-dnsHickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Service8.7 High
- hickory-dnsHickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requests8.7 High
- hickory-dnsHickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodies8.7 High
- sveltejs devalueDevalue before 5.6.3 Denial of Service via Sparse Array Serialization8.7 High
- sveltejs devalueSveltejs devalue before 5.6.3 Prototype Pollution via uneval Output2.1 Low
- sveltejs devalueSveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten6.3 Medium
- sveltejs devalueDevalue before 5.9.3 CPU Amplification Denial of Service via uneval8.7 High
- sveltejs devalueDevalue before 5.9.3 Quadratic Expansion Denial of Service via uneval8.7 High
- sveltejs devalueSveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays8.7 High
- sveltejs devalueDevalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse8.7 High
- sveltejs devalueDevalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection8.7 High
- sveltejs devalueSveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion6.3 Medium
- zcashfoundation zebraZebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block Body8.7 High
- zcashfoundation zebraZebra before 7.0.0 Denial of Service via Quadratic Sighash Computation8.7 High
- zcashfoundation zebraZebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier Rewind8.7 High
- zcashfoundation zebraZebra zebrad before 7.0.0 Reachable Assertion DoS via Peer Disconnection8.2 High
- zcashfoundation zebraZebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time Scoring6.9 Medium
- zcashfoundation zebraZebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification Failures8.7 High
- zcashfoundation zebraZebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity Check8.7 High
- openidentityplatform openamOpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated Login6.9 Medium
- openidentityplatform openamOpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point6.3 Medium
- openam consortium (openam consortium edition)Open redirect in the Liberty ID-FF service provider single sign-on flow5.1 Medium
- openidentityplatform openamOpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket10.0 Critical
- openidentityplatform openamOpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions9.3 Critical
- openidentityplatform openamOpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass9.3 Critical
- openidentityplatform openamOpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 Pages2.3 Low
- openidentityplatform openamOpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayState2.3 Low
- openidentityplatform openamOpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFail5.3 Medium
- openidentityplatform openamOpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device Flow7.1 High
- openidentityplatform openamOpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel6.1 Medium
- openidentityplatform openamOpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java Deserialisation8.7 High
- openidentityplatform openamOpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow7.6 High
- openidentityplatform openamOpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner Matching5.3 Medium
- openidentityplatform openamOpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POST2.0 Low
- openidentityplatform openamOpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display Name4.8 Medium
- openidentityplatform openamOpenAM before 16.1.4 SAML 1.x Signature Verification Issuer Impersonation7.5 High
- openidentityplatform openamOpenAM before 16.1.4 SSRF via UMA Scope Description URLs5.3 Medium
- openidentityplatform openamOpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLs5.1 Medium
- tornadoweb tornadoTornado before 6.6 Cookie Attribute Injection via set_cookie max_age2.3 Low
- tornadoweb tornadoTornado before 6.6 Path Traversal via static_url() Version Hashing8.3 High
- gitoxidelabs gitoxideGitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph File6.8 Medium
- gitoxidelabs gitoxidegix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC Probe7.1 High
- go-vikunja vikunjaVikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter8.7 High
- Show moreLoading…