high · CVSS v3 7.5 · CVSS v4 8.7

CVE-2026-123566

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplificatio…

Description

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the event loop.

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
8.7
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-123512

Vikunja versions prior to 2.7.1 expose password-reset, email-confirmation, and account-deletion tokens in URLs that are logged, allowing attackers with log access to replay tokens and compromise accounts. This flaw can lead to unauthorized account takeover or deletion. Defenders should update or patch the application immediately.

View analysis

high

CVE-2026-123513

Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.

View analysis

high

CVE-2026-123516

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice.

View analysis

high

CVE-2026-123517

Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member.

View analysis