CVE-2026-128129

The AIOHTTP asynchronous HTTP client/server framework for Python is vulnerable to unbounded memory consumption in versions prior to 3.14.4 . The root cause is that the framework buffers additional connection data during an upgrade request (such as a WebSocket handshake) without implementing a siz...

CVE-2026-128128

The AIOHTTP asynchronous HTTP framework is vulnerable to an integer overflow in its C WebSocket reader prior to version 3.14.4 . The vulnerability occurs because the reader uses signed 64-bit arithmetic to add a declared frame length to a buffered partial message. A length near $2^{63}$ can cause...

CVE-2026-128127

The AIOHTTP asynchronous HTTP framework for Python and asyncio is vulnerable to a memory exhaustion or event loop spinning issue in versions prior to 3.14.4 . The root cause lies in the BodyPartReader.read_chunk() function, which fails to enforce a byte limit when processing multipart parts with ...

CVE-2026-128126

The AIOHTTP asynchronous HTTP framework for Python and asyncio is vulnerable to a Denial of Service (DoS) condition prior to version 3.14.4 . The Request.post() method fails to limit the number of fields in a URL-encoded form body, allowing an attacker to insert many repeated keys into a MultiDic...

CVE-2026-89037

Dolibarr versions prior to 24.0.2 are vulnerable to an Insecure Direct Object Reference (IDOR) in the REST Documents API for the ticket module. The root cause is a missing company-scope check during API authentication, as the required session variable is only set during public ticket authenticati...

CVE-2026-128125

The aiohttp asynchronous HTTP framework for Python and asyncio is vulnerable to unbounded cookie storage in the client CookieJar prior to version 3.14.4 . The root cause is that Set-Cookie parsing treats unrecognized name=value attributes as additional cookies without limitations on the number of...

CVE-2026-92738

HashiCorp Vault 's Login MFA feature fails to consistently enforce the lifetime of pending two-phase login requests. This allows a user who completed the first authentication factor to finish the MFA process and obtain a Vault token even after the request should have expired, including after prim...

CVE-2026-128124

The AIOHTTP asynchronous HTTP framework for Python and asyncio is vulnerable to an event loop stall in the Application.add_domain() function. Prior to version 3.14.4 , the framework converts asterisk wildcards into greedy regular-expression fragments. When a domain mask contains two or more wildc...

CVE-2025-43867

A dependency on a vulnerable third-party component in Johnson Controls products allows for accessing, modifying, or deleting files (CAPEC-17). Affected products include FX Server (versions before 14.10.10 and 14.14.1), FX80 (versions before 14.14.10 and 14.14.1), and FX90 (versions before 14.10.1...

CVE-2026-128100

Vault Community Edition and Vault Enterprise are vulnerable to an ACL policy deny bypass because they do not apply explicit deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This flaw may allow an authenticated user with delegat...

CVE-2026-127215

The Kanbanz by Softaculous plugin for WordPress (versions before 1.0.3 ) is vulnerable to a broken access control flaw. The issue exists because admin-ajax handlers fail to properly call kanbanz_user_can_access_board() or perform per-task edit checks on attacker-supplied board_id or task_id param...

CVE-2026-128123

The @sveltejs/adapter-node component in SvelteKit is vulnerable to a denial of service (DoS) condition. From version 5.5.7 until versions 5.5.8 and 6.0.1 , the adapter can crash the server by attempting to add a header to an immutable request during certain fetch proxying operations. This crash p...

CVE-2026-128122

The @sveltejs/adapter-cloudflare component within the SvelteKit framework is vulnerable to an injection flaw in versions 4.7.0 through 7.2.10 and 8.0.2 . During the prerendering process, the adapter fails to perform output-context validation on links crawled from external sources. This allows an ...

CVE-2026-128121

The SvelteKit framework is vulnerable to a flaw where attacker-influenced links crawled during prerendering are emitted into the generated Vercel routing configuration without proper escaping of regular-expression metacharacters. This affects @sveltejs/adapter-vercel versions prior to 6.3.5 and 7...

CVE-2026-18742

The WordPress Flatsome theme (versions

CVE-2026-128120

The SvelteKit framework is vulnerable to a Denial of Service (DoS) attack when using the experimental remote functions flag with a remote form function. In versions 2.42.0 through 3.1.1 , parsing a specially crafted request containing many form entries can trigger quadratic synchronous work , blo...

CVE-2026-128119

The SvelteKit framework (versions 2.60.1 through 3.1.1 ) is vulnerable to a collision of identifiers for private query.batch functions when using the experimental remote functions flag. This root cause allows arguments intended for one function to be passed to another within a shared request batc...

CVE-2026-128118

The SvelteKit framework (versions 3.0.0 through 3.1.1) contains a build-time vulnerability where the server-only module guard fails to identify src/params.js as a client entry point. Because parameter matchers can execute in the browser, server-only modules imported via this file may be incorrect...

CVE-2026-128117

SvelteKit versions prior to 2.70.4 and 3.1.1 are vulnerable to a DoS issue where the reroute hook improperly handles malformed pathnames. Specifically, an invalid percent-encoded pathname could be rewritten into a valid route, leading the system to decode the malformed pathname outside of a guard...

CVE-2026-127214

Flowise versions through 3.1.4 are vulnerable to a Server-Side Request Forgery (SSRF) flaw within the Custom Function sandbox . Authenticated attackers with permissions to create or update chatflows or agentflows can bypass SSRF protections by requiring specific module subpaths (e.g., axios/dist/...

CVE-2026-128116

The SvelteKit framework is vulnerable to cross-origin script execution in versions prior to 2.70.4 and 3.1.1 . When configured with router.resolution: 'server', the application may treat pathnames starting with // as protocol-relative module specifiers during client-side navigation. This allows a...

CVE-2026-128089

The dnspython DNS toolkit for Python is vulnerable to excessive memory and CPU consumption in versions prior to 2.9.2 . The root cause is located in the from_text() parser for WKS records , which fails to validate that the service number is between 0 and 65535 before using it as a bitmap offset. ...

CVE-2026-68905

The Hugo Blog tech site contains a vulnerability in its AI assistant proxy (commit 744ca15 and prior). The proxy exposes three HTTP endpoints—POST /api/blog-assistant , POST /api/blog-search-embedding , and POST /api/blog-search-rerank —without any authentication checks. When using the documented...

CVE-2026-127213

The LearnPress Course Wishlist Add-on before version 4.1.2 is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the render_button callback uses a user-supplied user_id parameter instead of verifying the session identity. Attackers can exploit the publicly accessib...

CVE-2026-68551

Budget Board, a financial tracking application, is vulnerable to account takeover in versions prior to 3.6.2 . The flaw exists in the OIDC login flow , where the application authenticates users by matching the email address in the identity provider's token without verifying the email_verified cla...

CVE-2026-128088

The russh Rust SSH library (prior to version 0.65.1 ) is vulnerable to a TOCTOU (Time-of-check Time-of-use) race condition in its SSH agent protocol implementation. The try_sign() function captures a private key but fails to revalidate the shared lock state after awaiting the asynchronous Agent::...

CVE-2026-129217

FRRouting (FRR) versions 8.3 through 10.5.1 are vulnerable to an out-of-bounds heap read and subsequent crash in the bgpd daemon. The flaw exists in the bgp_notify_decapsulate_hard_reset() function within bgpd/bgp_packet.c, which fails to validate the data field length of received BGP NOTIFICATIO...

CVE-2026-68541

Prior to version 1.4.1 , the compliance policy management tool PolicyPress is vulnerable to sensitive content disclosure. This is caused by CSS-only web redaction and insecure starter workflow defaults . The issue has been resolved in version 1.4.1 . No specific exploit details or in-the-wild exp...

CVE-2026-128087

The russh Rust SSH library (versions 0.55.0 through 0.65.0 ) contains a flaw where the client::Handler::kex_done() callback is invoked with the raw shared secret before the server's host key or certificate is verified by check_server_key(). This allows a malicious SSH server to trigger applicatio...

CVE-2026-67444

Hubleys , a dashboard for self-hosted services, is vulnerable to Stored XSS prior to version 0.5.2 . An authenticated non-admin user can upload a file with an arbitrary extension as a dashboard "background image." The server serves this file back with a Content-Type derived directly from the atta...

CVE-2026-68510

The bit-vec library (a compact vector of bits) is vulnerable to undefined behavior in versions prior to 0.10.0 . The root cause is unsoundness occurring when a user performs a deserialize operation from an untrusted source followed by an unsafe get_unchecked call. Impacted users may experience in...

CVE-2026-128086

The OpenTelemetry-Go Go implementation (go.opentelemetry.io/otel) contains a vulnerability where baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property. This behavior causes bounded but disproportionate memory-allocation amplification when processing valid, d...

CVE-2026-128085

The OpenTelemetry-Go library contains a defect where the AttributeValueLengthLimit is bypassed by attribute values composed of valid U+FFFD (REPLACEMENT CHARACTER) runes. In versions 1.33.0 (SDK), 0.9.0 (SDK log), and 1.35.0 (trace) through 1.47.0 , the optimistic truncation path fails to count t...

CVE-2026-64675

The BACnet Stack , an open-source protocol stack C library for embedded systems, is vulnerable to an out-of-bounds read in the xy_color_decode() function located in src/bacnet/lighting.c. This flaw is triggered by a single unauthenticated BACnet/IP UDP datagram on port 47808 . The vulnerability i...

CVE-2026-128084

The sqlite3-ruby library is vulnerable to SQL query truncation on 64-bit platforms because it casts Ruby string lengths (long) to integers before passing them to SQLite. Strings of 4 GiB (2^32 bytes) or larger cause the length to wrap, leading SQLite to process only a prefix. This can result in d...

CVE-2026-128083

The Laravel web application framework is vulnerable to a Task Output Injection flaw in the Concurrency::run process driver. If an application route invokes Concurrency::run and a task writes user-controlled data to standard output (e.g., via echo, print, or dd), an attacker can forge an internal ...

CVE-2026-104204

The BACnet Stack , an open-source C library for embedded systems, is vulnerable to a server-side denial-of-service (DoS) attack in versions prior to 1.6.1 . The root cause lies in the Structured View object implementation , where the subordinate-list[0] WriteProperty allows for unbounded synchron...

CVE-2026-102612

The BACnet Stack C library for embedded systems contains a vulnerability in versions prior to 1.4.6, 1.5.2, and 1.6.1 . The root cause is located in bws_srv_start() within ports/linux/websocket-srv.c, where the libwebsockets server context is built with a CA certificate but fails to set the LWS_S...

CVE-2026-97692

The BACnet Stack , an open source C library for embedded systems, contains a vulnerability in the BACnet/SC message decoder prior to versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0. The decoder processes the header-option list by following the MORE bit but lacks an upper bound on the number of options pr...

CVE-2026-102537

The BACnet Stack , an open-source C library for embedded systems, is vulnerable to a Man-in-the-Middle (MITM) attack in versions prior to 1.4.6, 1.5.2, and 1.6.1 . The root cause is located in bws_cli_connect() within ports/linux/websocket-cli.c, where the library loads a trusted CA certificate b...

CVE-2026-100403

The BACnet Stack , an open source C library for embedded systems, contains a vulnerability in the BACnet/SC hub's Linux WebSocket server . The server reassembles fragmented WebSocket messages into a per-connection fragment_buffer using realloc(), but lacks an upper bound on growth. A remote peer ...

CVE-2026-82414

The BACnet Stack C library, an open source protocol stack for embedded systems, contains a decode overflow vulnerability in the MS/TP receive path. Affecting versions 1.4.0 to before 1.4.6 , 1.5.0 to before 1.5.1 , and 1.6.0 to before 1.6.1 , the library decodes COBS frames into an output pointer...

CVE-2026-62977

The BACnet Stack C library for embedded systems contains a vulnerability in its FILE object implementation prior to versions 1.5.1 and 1.6.0 . The issue allows remote WriteProperty(PROP_FILE_SIZE) requests to modify the size of a stream-access FILE object without verifying if the file is marked R...

CVE-2026-62976

The BACnet Stack C library for embedded systems is vulnerable to a heap out-of-bounds read in the RAMFS-backed FILE object implementation prior to version 1.5.1 . The root cause is a logic error where the system stores appended records as NUL-terminated strings but processes the buffer as if an a...

CVE-2026-62975

The BACnet Stack C library for embedded systems is vulnerable to a heap out-of-bounds read in versions prior to 1.5.1. The issue exists in the RAMFS-backed FILE implementation when processing AtomicWriteFile(record-access) requests. Specifically, if a client replaces an existing record with short...

CVE-2026-128082

The AutoMapper library for .NET is vulnerable to uncontrolled recursion (CWE-674) due to how it handles constructor parameters. Specifically, in versions prior to 15.1.4 and from 16.0.0 until 16.3.0 , the library increments type depth only after creating the destination object. This allows recurs...

CVE-2026-128081

The AutoMapper library for .NET is vulnerable to a Denial of Service attack due to uncontrolled recursion that bypasses the MaxDepth limit. This flaw occurs when mapping polymorphic graphs through Include , IncludeBase , runtime-typed members, nested Dictionary or ExpandoObject sources, or recurs...

CVE-2026-128080

The @opentelemetry/instrumentation-http component within the OpenTelemetry JavaScript client (versions 0.204.0 through 0.222.0 ) is vulnerable to the exposure of sensitive information. The root cause is that the library writes raw query strings from incoming HTTP requests to the url.query server-...

CVE-2026-97361

The SpaceCom and Space Battery pack SP with WiFi (including the Data module compactplus ) are affected by an improper privilege management vulnerability (CWE-269). This flaw could lead to privilege escalation within the affected hardware. No specific root cause, patch versions, or exploit details...

CVE-2026-97358

CVE-2026-97358 involves the inclusion of web functionality from an untrusted source , which could lead to remote code execution on SpaceCom devices. Specifically, the vulnerability affects B. Braun SpaceCom , the Battery Pack SP with Wi-Fi , and the Data module compactplus . While the base severi...