Dropbox

Products

Exploited and recent CVEs

• CVE-2026-93471 High 8.7 Unbounded SAML message decompression in esaml allows memory exhaustion 0.7%
• CVE-2026-86696 High 8.2 Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion 0.7%
• CVE-2026-105270 High 8.7 Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion 0.5%
• CVE-2026-81102 Low 3.1 Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation 0.2%
• CVE-2026-53424 Critical 9.1 Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions 0.6%
• CVE-2026-53425 High 7.6 Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses 0.2%
• CVE-2026-28809 Medium 6.3 XXE in esaml SAML library allows local file read and potential SSRF 0.3%
• CVE-2024-5924 High 8.8 Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability 1.2%
• CVE-2022-4768 Medium 6.3 Dropbox merou SSH Public Key public_key.py add_public_key injection 0.7%