Fabric
15 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Fabric, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Fabric CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 1 |
| 2026-01 | 0 |
| 2026-02 | 1 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 1 |
| 2026-09 | 2 |
Severity
How the 15 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High10
- Medium2
Latest CVEs
The 15 most recently published vulnerabilities affecting Fabric.
- CVE-2026-69843Microsoft Fabric Elevation of Privilege Vulnerability10.0
- CVE-2026-70178Microsoft Fabric Elevation of Privilege Vulnerability8.5
- CVE-2026-63509Microsoft Fabric Elevation of Privilege Vulnerability9.9
- CVE-2026-41586ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE9.8
- CVE-2026-27013Fabric.js Affected by Stored XSS via SVG Export7.6
- CVE-2025-58941WordPress Fabric theme <= 1.5.0 - Local File Inclusion vulnerability8.1
- CVE-2024-45244Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.5.3
- CVE-2024-29154danielmiessler fabric through 1.3.0 allows installer/client/gui/static/js/index.js XSS because of innerHTML mishandling, such as in htmlToPlainText.7.4
- CVE-2023-46132Crosslinking transaction attack in hyperledger/fabric7.1
- CVE-2022-45196Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the same Channel name. NOTE: the official Fabric with Raft preve...7.5
- CVE-2022-36023Remote denial of service in Hyperledger Fabric Gateway7.0
- CVE-2022-31121Improper Input Validation in fabric hyperledger7.5
- CVE-2021-43669A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a ...7.5
- CVE-2021-43667A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'fo...7.5
- CVE-2011-2185Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on (1) a /tmp/fab.*.tar file or (2) certain other files in the top level of /tmp/.4.4
Product grouping is registry-driven, with AI assist and human review. How it works