Dropbox vulnerabilities
9 published CVEs name Dropbox among the affected products.
- 9Published CVEs9 of them scored
- 7Last 12 monthspublished in the last year
- 1Critical5 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-93471
Unbounded SAML message decompression in esaml allows memory exhaustion
handnot2 · esaml
High8.7 - CVE-2026-86696
Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion
handnot2 · esaml
High8.2 - CVE-2026-105270
Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
arekinath · esaml
High8.7 - CVE-2026-81102
Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation
dropbox · mcp-server-dash
Low2.3 - CVE-2026-53424
Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions
dropbox · samly
Critical9.1 - CVE-2026-53425
Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses
dropbox · samly
High7.6 - CVE-2026-28809
XXE in esaml SAML library allows local file read and potential SSRF
dropbox · esaml
Medium6.3 - CVE-2024-5924
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability
Dropbox · Dropbox Desktop
High8.8 - CVE-2022-4768
Dropbox merou SSH Public Key public_key.py add_public_key injection
Dropbox · merou
Medium6.3