CVE-2026-123569 is a high-severity vulnerability in the sveltejs devalue package before version 5.6.3. It allows an attacker to cause excessive CPU and memory consumption by serializing sparse arrays on the server, potentially leading to denial of service. This issue arises because the package does not limit or throttle resource allocation during serialization of such arrays. The vulnerability is fixed in version 5.6.3.
Sveltejs devalue versions before 5.6.3 have a prototype pollution vulnerability. This flaw allows attackers to manipulate object prototypes by providing untrusted input to the uneval function. When the affected code evaluates this input, it results in objects with altered prototypes, causing output data to differ in structure from the original input. The vulnerability has a low severity score and was fixed in version 5.6.3.
CVE-2026-123567 is a prototype pollution vulnerability in the sveltejs devalue library before version 5.6.4. It allows attackers to inject __proto__ properties into objects returned by devalue.parse and devalue.unflatten. This can lead to modification of an object's prototype when downstream code merges these objects using Object.assign. The vulnerability is fixed in version 5.6.4.
Sveltejs devalue versions before 5.9.3 contain a denial of service vulnerability where attackers can cause CPU amplification by supplying sparse arrays to the uneval function. This forces synchronous work proportional to the declared array length, blocking the event loop and potentially causing application unavailability.
CVE-2026-123565 is a high-severity resource exhaustion vulnerability in the sveltejs devalue library before version 5.9.3. The vulnerability arises from the uneval function, which can experience quadratic expansion when processing repeated primitive strings. An attacker can craft a small payload that, when parsed and passed to uneval, results in a very large serialized string that exhausts system memory or CPU resources. This flaw was fixed in version 5.9.3.
CVE-2026-123564 is a high-severity memory exhaustion vulnerability in the sveltejs devalue library versions from 1.0.0 up to but not including 5.9.3. The flaw exists in the uneval function, which generates code for sparse arrays that allocates memory proportional to the array's declared length during evaluation. An attacker able to influence a very large sparse array serialized by an application can cause memory exhaustion in the browser or runtime environment. This issue is fixed in version 5.9.3.
A vulnerability in the sveltejs devalue library before version 5.9.3 allows attackers to bypass validation in the parse function via custom ArrayBuffer revivers. This flaw enables the allocation of excessively large ArrayBuffers from crafted small inputs, leading to memory exhaustion and denial of service.
A vulnerability in sveltejs devalue versions 5.8.0 through before 5.9.3 causes an unhandled promise rejection during asynchronous serialization. This occurs when multiple promises are serialized and a later promise rejects before an earlier one settles, leaving an internal rejection unhandled even if the caller catches the returned promise. An attacker who can influence the timing or failure of these promises may cause the Node.js process to terminate unexpectedly.
CVE-2026-123561 is a prototype pollution vulnerability in the sveltejs 'devalue' package before version 5.9.3. It allows attackers to bypass the existing __proto__ rejection by using malformed null-prototype object keys through property-key coercion. Although the crafted payloads yield objects with a __proto__ own property, this alone does not cause prototype pollution. The issue is an incomplete fix of a previous vulnerability (GHSA-mwv9-gp5h-frr4).
Zebra versions before 7.0.0 have a vulnerability where unauthenticated peers can stall the initial synchronization process by sending a forged checkpoint block body. This forged data causes the node to reject certain hashes and stop requesting further blocks until it is restarted. The issue is fixed in version 7.0.0.
Zebra versions before 7.0.0 have an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. This causes quadratic digest recomputation under ZIP-244 or ZIP-243, stalling block verification for minutes. The issue is fixed in version 7.0.0.
Zebra zebrad versions prior to 7.0.0 contain a denial of service vulnerability where a malicious peer can stall checkpoint synchronization by cancelling the verifier rewind after a failed commit. This causes the verifier to reject honest blocks until the service is restarted. The issue is fixed in version 7.0.0.
ZcashFoundation Zebra versions before 7.0.0 contain a reachable assertion race condition that can be triggered by unauthenticated remote peers. This flaw allows malicious peers to abort the node by causing disconnection during a blocked outbound send. Attackers can exploit this by sending empty FindBlocks or FindHeaders replies and ceasing to read their socket, which leads to unresolved client response handling and termination of syncing nodes. The issue is fixed in version 7.0.0.
ZcashFoundation Zebra versions from 4.5.0 up to but not including 7.0.0 have a protection mechanism failure that causes honest peers to be banned incorrectly. This occurs because the software scores mempool lock-time rejections at the ban threshold, allowing attackers to trigger bans by broadcasting transactions locked until the current block height. Affected nodes may ban honest relaying peers for 24 hours or until they restart. The issue is fixed in version 7.0.0.
Zebra versions from 2.3.0 up to but not including 7.0.0 contain a denial of service vulnerability. This flaw allows unauthenticated peers to bypass misbehavior scoring by submitting transactions or blocks with invalid transparent scripts. Exploitation can lead to CPU exhaustion and repeated stalling of block synchronization.
Zebra zebrad versions 6.4.0 up to but not including 7.0.0 contain an inefficient algorithmic complexity issue in the mempool coinbase-maturity check. This inefficiency arises because the function Transaction::coinbase_spend_restriction() rebuilds the transaction's output list repeatedly for each spent outpoint, resulting in quadratic computational work. An attacker controlling a connected peer can exploit this by sending many unsigned transactions with numerous transparent inputs and outputs, which are rejected without penalty but cause verification threads to be pinned.
OpenAM versions prior to 16.1.4 include built-in identities with default passwords that are the same across all installations and publicly known. This allows unauthenticated remote attackers to log in as these identities and obtain authenticated sessions. Agent identities can also read configuration data of other agent profiles. The vulnerability is fixed in OpenAM version 16.1.4.
OpenAM versions prior to 16.1.4 contain a server-side request forgery (SSRF) vulnerability in the certificate CRL checking process. This flaw allows an attacker with a trusted CA-chained certificate to make OpenAM fetch certificate revocation lists (CRLs) from arbitrary locations without proper destination restrictions or signature verification. Exploitation can lead to unauthorized internal network requests, credential capture, revocation data manipulation, and denial of certificate authentication.
OpenAM versions from 14.0.0 up to but not including 16.1.4 have an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens via the notification WebSocket. This occurs due to bypassing an agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, enabling attackers to collect iPlanetDirectoryPro tokens and hijack user and administrator sessions. The vulnerability is critical and has been fixed in version 16.1.4.
OpenAM versions before 16.1.4 have an authentication bypass vulnerability in the SAML v2.0 service provider. This flaw allows unauthenticated remote attackers to submit forged unsigned assertions via ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false, enabling them to impersonate any mapped user, including administrators, and hijack single sign-on sessions.