BishopFox has 5 CVEs on record between 2023 and 2026. 3 were published in the last 90 days. The median CVSS is 8.4 (high), with 1 rated critical. None have a confirmed exploitation report. Most affected products: github.com/BishopFox/sliver (2), sliver (2), github.com/BishopFox/joro (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.4
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Products
- github.com/BishopFox/sliver 2
- sliver 2
- github.com/BishopFox/joro 1
Worst active — by depth score
CVE-2026-34227High· 8.8Sliver is a command and control framework that uses a custom Wireguard netstack60CVE-2026-77622HighSliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder53CVE-2026-53649Critical· 9.6Joro is a web exploitation framework53CVE-2023-34758High· 8.1Silver vulnerable to MitM attack against implants due to a cryptography vulnerability45CVE-2026-102507Medium· 5.7Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or emp…43
BishopFox vulnerabilities
CVEs affecting BishopFox, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-77622HighPoCSliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
CVE-2026-102507Medium· 5.7PoCSliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or emp…
Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or emp…
CVE-2026-53649Critical· 9.6Joro is a web exploitation framework
Joro is a web exploitation framework. Prior to version 1.1.1, Joro's default proxy mode exposes a local API on 127.0.0.1:9090 that performs no authentication and applies a wildcard CORS policy. Because plugin uploads use the CORS-safelis…
CVE-2026-34227High· 8.8PoCSliver is a command and control framework that uses a custom Wireguard netstack
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beaco…
CVE-2023-34758High· 8.1Silver vulnerable to MitM attack against implants due to a cryptography vulnerability
Silver vulnerable to MitM attack against implants due to a cryptography vulnerability