Dropbox vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20241
3. 20267

Newest CVEs

• CVE-2026-93471

  Unbounded SAML message decompression in esaml allows memory exhaustion

  handnot2 · esaml

  High8.7
• CVE-2026-86696

  Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

  handnot2 · esaml

  High8.2
• CVE-2026-105270

  Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion

  arekinath · esaml

  High8.7
• CVE-2026-81102

  Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation

  dropbox · mcp-server-dash

  Low2.3
• CVE-2026-53424

  Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions

  dropbox · samly

  Critical9.1
• CVE-2026-53425

  Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses

  dropbox · samly

  High7.6
• CVE-2026-28809

  XXE in esaml SAML library allows local file read and potential SSRF

  dropbox · esaml

  Medium6.3
• CVE-2024-5924

  Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability

  Dropbox · Dropbox Desktop

  High8.8
• CVE-2022-4768

  Dropbox merou SSH Public Key public_key.py add_public_key injection

  Dropbox · merou

  Medium6.3