Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-85219

Denial-of-Service in the OpenCanary Redis service

Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Thinkst Applied Research
Products
Opencanary
CVE-2026-85220

Denial-of-Service in the Thinkst Canary Redis service

A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot. The vulnerability is accessible when the Redis service is enabled only. The Canary is NOT affected if the Redis service is disabled. Thinkst has addressed this issue on all supported platforms. New update files to address this issue are available on all platforms except Docker. For Docker customers, a new Docker image has been published which includes the patch. Customers with automatic updates enabled already have updates in distribution. If automatic updates are disabled, customers are advised to update their Canaries. Workarounds are available for customers unable to update at this time.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Thinkst Applied Research
Products
Opencanary
CVE-2026-16551

Denial-of-Service in OpenCanary's MongoDB module

Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation. This issue affects OpenCanary 0.9.8 only.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Thinkst Applied Research
Products
Opencanary
CVE-2026-13140

Stored Cross-Site Scripting in Canarytokens.org

Stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier. This issue affects Canarytokens: from Docker tag sha-4116b92cb before sha-f5aa5c4e, from Git commit 4116b92cb before f5aa5c4e.

CVSS 4.0 · 1.1 Low EPSS < 1% KEV · Not listed
Vendors
Thinkst Applied Research
Products
Canarytokens
CVE-2026-12888

HTML injection in the Canarytoken Google Chat notification

An HTML injection vulnerability exists in the Google Chat webhook notification  sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation in Google Chat. An attacker can insert limited HTML content including links. This issue affects Canarytokens: from Docker tag sha-4aef1db90 before sha-8ab4dccd, from Git commit 4aef1db90 before 8ab4dccd.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Thinkst Applied Research
Products
Canarytokens
CVE-2026-11859

HTML injection in the Canarytoken links email

An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c0f3cf142 before sha-08c3f93d, from Git commit c0f3cf142 before 08c3f93d.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Thinkst Applied Research
Products
Canarytokens
CVE-2026-10729

HTML injection in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens

An HTML injection vulnerability in the notification email for "Slow Redirect" and "Cloned Website" Canarytokens exists in Thinkst Applied Research Canarytokens, enabling Interface Manipulation, Cross-Site Scripting (XSS) in emails clients that render HTML emails. This issue affects Canarytokens: from Docker tag sha-c42435e before sha-bfda4df, from Git commit c42435e before bfda4df.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Thinkst Applied Research
Products
Canarytokens