BishopFox vulnerabilities
We track 6 vulnerabilities in BishopFox products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.
Latest BishopFox vulnerabilities
- 8.2 High severity
sliver: Allocation of Resources Without Limits or Throttling
Sliver is a command and control framework. Prior to 1.7.6, an HTTP(S) listener using the PNG encoder accepts attacker-controlled PNG dimensions without an effective decoded-size or pixel limit in util/encoders/images.go, while the listener nonce space implemen
- 9.6 Critical severity
joro: Missing Authentication for Critical Functionality
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelisted multipart/form-data
- 8.8 High severity
sliver: Missing Authentication for Critical Functionality
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrat
- 7.5 High severity
sliver: Missing Authentication for Critical Functionality
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is e
- 7.2 High severity
sliver: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver version 1.6.0 (prerelease) is vulnerable to RCE on the teamserver by a low-privileged "operator" us
- 8.1 High severity
Sliver: Use of a Broken or Risky Cryptographic Algorithm
Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses.