CVE-2026-128118

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build-time server-only module guard did not treat src/params.js as a client entry point even though parameter matchers can run in the browser. Server-only modules...

CVE-2026-128118

The SvelteKit framework (versions 3.0.0 through 3.1.1) contains a build-time vulnerability where the server-only module guard fails to identify src/params.js as a client entry point. Because parameter matchers can execute in the browser, server-only modules imported via this file may be incorrect...

CVE-2026-62972

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lightingcommanddecode in src/bacnet/lighting.c decodes its first field with the bounded apdusize - apdulen, but every nested decode in the operation switch is called with...

CVE-2026-62972

The BACnet Stack , an open source protocol stack C library for embedded systems, is vulnerable to an out-of-bounds read in the lighting_command_decode function located in src/bacnet/lighting.c. The flaw occurs because while the first field is decoded using a bounded size, subsequent nested decode...

CVE-2026-128991

xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in readxschemfile in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a "" record, causing xschem to read and dereference memory below th...

CVE-2026-128990

The xschem versions 2.9.9 through 3.4.7 are affected by a heap out-of-bounds write vulnerability in the read_dataset() function within src/rawtovcd.c . This issue stems from an unchecked variable index , allowing an attacker to provide a crafted ngspice .raw file that, during conversion via rawto...

EUVD-2026-125402

xschem 2.9.9 through 3.4.7 contains a heap out-of-bounds write vulnerability in readdataset in src/rawtovcd.c due to an unchecked variable index. Attackers can supply a crafted ngspice .raw file that, when converted with rawtovcd, writes file-controlled heap pointers at chosen signed offsets,...

EUVD-2026-125401

xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in readxschemfile in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a "" record, causing xschem to read and dereference memory below th...

CVE-2026-128991

The software xschem (versions 2.9.9 through 3.4.7 ) contains an out-of-bounds read vulnerability within the read_xschem_file() function in src/save.c. The flaw arises because the software mishandles embedded-symbol records that lack a preceding instance. An attacker can provide a crafted schemati...

rdx

Android API type and exception facts src/nativeresourcenames.rs contains framework attribute IDs and names from Android SDK 36 data/res/values/public-final.xml, with its source SHA-256 recorded in the generated file. Binary XML uses this catalog to restore framework attribute names and namespaces...

CVE-2026-126482

OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a...

CVE-2026-126451 OpenEMR before 8.5.0 Stored XSS via Document Template Rendering

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document templatedata. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by...

CVE-2026-126451

OpenEMR versions prior to 8.5.0 are vulnerable to a stored cross-site scripting (XSS) flaw during Document Template Rendering . The root cause is the DocumentTemplateRender function, which fails to sanitize an encounterForm value rendered into an iframe src. This allows portal patients to inject ...

CVE-2026-126482

OpenEMR versions before 8.5.0 are vulnerable to an SQL injection in the SLEOB::slInvoiceNumber() function located in src/Billing/SLEOB.php. The root cause is the lack of escaping or parameter binding when the application concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into...

EUVD-2026-124942

OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a...

CVE-2026-128239 GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers

GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a...

CVE-2026-128240

GPAC versions through 26.07.0 are vulnerable to a use-after-free vulnerability in the gf_sg_proto_del() function located in src/scenegraph/vrml_proto.c. The root cause is that gf_sg_reset() frees unregistered prototypes that are still referenced by scene commands. An attacker can provide a crafte...

9router <=0.5.4 - Authentication Bypass

9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation...

CVE-2026-16659 Pre-authentication NULL pointer dereference in MCUboot serial-recovery image upload (encrypted-image builds)

MCUboot's serial-recovery image-upload handler bsupload in boot/bootserial/src/bootserial.c declares const struct flasharea fap = NULL and assigns it only via flashareaopen part-way through the function. Two early validation failures goto outinvaliddata — a CBOR map that fails to decode, or an...

CVE-2026-16662 Uninitialised bootloader stack disclosed into the measured-boot attestation record via a short EXPECTED_HASH TLV in MCUboot

bootsavebootstatus in boot/bootutil/src/bootrecord.c reads the image's EXPECTEDHASHTLV into a stack buffer imagehashIMAGEHASHSIZE that is never zero-initialised. The TLV handler validates only the upper bound len sizeofimagehash and then reads exactly len bytes, so a TLV shorter than IMAGEHASHSIZ...