The @opentelemetry/instrumentation-http package for Node.js versions >=0.204.0 and <0.222.0 improperly handles sensitive query parameters in incoming HTTP requests. While outgoing client spans redact sensitive URL query parameters, incoming server spans do not, resulting in raw query strings—including credentials like AWS presigned URLs, Azure SAS tokens, and GCS signed URLs—being recorded in plaintext in the url.query attribute. This sensitive information is then exported to the tracing backend, exposing valid credentials to anyone with access to telemetry data. The issue is patched in version 0.222.0, which redacts sensitive query parameters by default for incoming spans and introduces a redactedQueryParamsServer option for customization.
CVE-2026-128117 is a vulnerability in SvelteKit prior to versions 2.70.4 and 3.1.1 where an unhandled URIError exception can occur due to improper handling of invalid percent-encoded pathnames in the reroute hook. This can cause an adapter-node server to crash and result in a denial of service. The issue is fixed in versions 2.70.4 and 3.1.1.
FlowiseAI Flowise versions up to 3.1.4 contain a server-side request forgery (SSRF) vulnerability. Authenticated users with permissions to create or update chatflows or agentflows can bypass the Custom Function sandbox's SSRF protections by requiring specific module subpaths inside allowlisted packages. This bypass returns an unwrapped HTTP client that skips validation, allowing attackers to send arbitrary HTTP requests to internal network addresses or cloud metadata endpoints. This can lead to network mapping, credential disclosure, and unauthorized state changes on internal services.
CVE-2026-128116 is a cross-site scripting (XSS) vulnerability in SvelteKit, a web application framework. Versions prior to 2.70.4 and 3.1.1, when configured with router.resolution set to 'server', could misinterpret pathnames starting with // as protocol-relative module specifiers during client-side navigation. This flaw allows an attacker to craft a link that causes the server-side route resolution to import and execute JavaScript from an external origin in the user's browser. The vulnerability is fixed in versions 2.70.4 and 3.1.1.
A vulnerability in dnspython prior to version 2.9.2 allows an attacker to cause uncontrolled resource consumption via the from_text() parser for WKS records. The parser does not validate that the service number is within the valid range (0 to 65535), enabling an attacker to supply a larger number that causes excessive memory and CPU usage, potentially terminating the process. This affects applications parsing attacker-controlled zone-file text with WKS records. The issue is fixed in dnspython version 2.9.2.
CVE-2026-68905 is a vulnerability in the lanshi17 hugo_blog project where three HTTP endpoints exposed by the AI assistant proxy lack authentication. This allows unauthenticated remote attackers to send arbitrary requests that are forwarded to upstream APIs using the operator's server-side API keys, potentially leading to quota exhaustion and service disruption. No patches are available at the time of publication.
AutoMapper versions prior to 16.3.0 and before 15.1.4 have a vulnerability where the MaxDepth recursion limit is not enforced when mapping destination types constructed via constructor parameters, such as positional records. This leads to uncontrolled recursion and a StackOverflowException that terminates the process. The flaw bypasses the MaxDepth mitigation introduced for a related vulnerability (CVE-2026-32933).
LearnPress Course Wishlist Add-on versions before 4.1.2 contain an insecure direct object reference vulnerability. This flaw allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback. The vulnerability is exploitable via a publicly accessible REST route that requires only a public wp_rest nonce, enabling attackers to add or remove courses from any user's wishlist and enumerate wishlist status by iterating user_id and course_id values. The issue is fixed in version 4.1.2.
Budget Board versions prior to 3.6.2 have an improper authentication vulnerability in their OIDC login flow. The app signs into existing local accounts based solely on the email address from the identity provider's token without verifying the email ownership via the email_verified claim. This flaw allows an attacker to register with a victim's email on the OIDC provider and gain unauthorized access to the victim's Budget Board account, including sensitive linked bank data. The issue is fixed in version 3.6.2.
OpenTelemetry-Go versions from 1.0.0-RC1 up to but not including 1.47.0 contain a vulnerability in the baggage metadata parsing implementation. The library eagerly materializes W3C baggage properties during parsing, causing bounded but disproportionate memory allocation amplification when processing densely populated headers. This can lead to increased memory allocation and garbage collection pressure, especially on services that enable baggage propagation and extract attacker-controlled context before authentication. The issue does not reliably cause out-of-memory conditions or complete denial of service. The vulnerability is fixed in version 1.47.0 by introducing lazy materialization of properties and in-place validation and normalization.
CVE-2026-128088 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Eugeny russh Rust SSH client and server library. The flaw exists in versions >=0.65.0 and <0.65.1 where the try_sign() function captures a private key reference before awaiting a confirmation step but does not revalidate the lock state afterward. This allows a remote SSH server using agent forwarding to bypass the current lock state during a signature request. The issue is fixed in version 0.65.1.
CVE-2026-129217 is an out-of-bounds read vulnerability in FRRouting versions 8.3 through 10.5.1. The flaw occurs in the bgp_notify_decapsulate_hard_reset() function when processing a BGP NOTIFICATION Cease/Hard Reset message with a one-byte data field. This causes a heap buffer over-read and an assertion failure, leading to a crash of the bgpd daemon and denial of service by terminating all BGP sessions. The issue is fixed in versions 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2, and 10.6.0.
PolicyPress, a compliance policy management tool, had a vulnerability prior to version 1.4.1 where sensitive information could be exposed due to CSS-only web redaction and insecure workflow defaults. This issue was addressed and fixed in version 1.4.1. The vulnerability has a medium severity rating with a CVSS score of 5.2.
russh, a Rust SSH client and server library, had a vulnerability in versions 0.55.0 through 0.65.0 where the initial key exchange invoked a callback with the raw shared secret before verifying the server's host key or certificate. This could allow a malicious SSH server to trigger certain client-side actions prematurely, even if the server identity is later rejected. The issue is fixed in version 0.65.1.
CVE-2026-67444 is a cross-site scripting (XSS) vulnerability in knrdl's hubleys-dashboard prior to version 0.5.2. Authenticated non-admin users could upload files with arbitrary extensions as dashboard background images, including .html files. These files are served with a Content-Type based on the file extension without applying the app's Content-Security-Policy, allowing embedded scripts to run unrestricted. This issue has been fixed in version 0.5.2.
A vulnerability in go.opentelemetry.io/otel/sdk allows the AttributeValueLengthLimit truncation to be bypassed by attribute values composed entirely of valid U+FFFD (REPLACEMENT CHARACTER) runes. This occurs because the truncation logic incorrectly skips counting these runes, allowing values to exceed the configured length limit. The issue affects versions starting from v1.33.0 up to but not including v1.47.0, including the auto-instrumentation tracer introduced in v1.35.0. The flaw is a regression introduced by a previous fix and is distinct from the original issue fixed before v1.33.0. A patch is available in version 1.47.0.
The sqlite3-ruby library improperly casts Ruby string lengths from long to int before passing them to SQLite, causing string lengths of 4 GiB or larger to wrap on 64-bit platforms. This results in SQL query truncation where only the first length mod 2^32 bytes are processed. An attacker controlling the SQL string length could truncate queries, potentially dropping trailing clauses such as WHERE. The issue affects SQL strings passed to Database#prepare, #execute, bound parameters, and Ruby-defined SQL functions and aggregates. The vulnerability is fixed in sqlite3-ruby version 2.10.2, which raises a RangeError for strings longer than INT_MAX bytes.
CVE-2026-68510 affects the contain-rs bit-vec library prior to version 0.10.0. The vulnerability involves improper input validation leading to undefined behavior when deserializing BitVec data from untrusted sources and subsequently using unsafe get_unchecked operations. This can cause incorrect behavior in applications using the affected versions. The issue is fixed in version 0.10.0.