CVE-2026-128086 is a medium severity vulnerability in the open-telemetry opentelemetry-go library affecting versions from 1.0.0-RC1 up to but not including 1.47.0. The issue involves uncontrolled resource consumption caused by the eager materialization of every W3C baggage property during baggage parsing and extraction. This can lead to increased memory allocation and garbage collection pressure when processing densely populated baggage headers. Remote exploitation requires that baggage extraction be enabled, attacker-controlled input reaches the extraction process, and that extraction occurs before authentication or on a public route. The vulnerability does not reliably cause process termination. The issue is fixed in version 1.47.0.
CVE-2026-128085 is a vulnerability in the open-telemetry opentelemetry-go SDK affecting versions from 0.9.0, 1.33.0, and 1.35.0 up to but not including 1.47.0. The issue involves incorrect calculation of multi-byte string length where valid U+FFFD replacement characters are not counted in truncation logic. This allows attacker-controlled telemetry attributes to exceed configured memory and character limits, increasing memory retention and pipeline pressure. The vulnerability does not affect confidentiality or integrity. It is fixed in version 1.47.0.
An out-of-bounds read vulnerability exists in the bacnet-stack library prior to versions 1.4.5 and 1.5.1. This flaw is triggered by a single unauthenticated BACnet/IP UDP datagram on port 47808, specifically through the UnconfirmedRequest WriteGroup service and Confirmed WriteProperty on a BACnetXYColor-typed property. The vulnerability has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
A numeric type conversion flaw in sqlite3-ruby prior to version 2.10.2 causes string lengths to be cast to int on 64-bit platforms. This can truncate SQL strings or bound values larger than 4 GiB, potentially dropping trailing SQL clauses such as WHERE conditions. If a dropped clause contained a bind placeholder, an exception is raised instead of executing the query. The issue is fixed in version 2.10.2.
CVE-2026-128083 is a deserialization vulnerability in the Laravel framework's Concurrency::run process driver prior to versions 12.71.0 and 13.40.0. Under specific application conditions where untrusted input is routed into task output, an attacker can forge an internal result message by injecting a crafted JSON document followed by gzip bytes into a child process's standard output. This can lead to remote code execution. The vulnerability is not exposed by default and requires particular application code patterns. It is fixed in Laravel versions 12.71.0 and 13.40.0.
A denial-of-service vulnerability exists in the BACnet Stack open source protocol library for embedded systems, specifically affecting the Structured View object implementation. Versions prior to 1.6.1 are vulnerable. This issue has been addressed and patched in versions 1.6.1 and 1.7.0.
A vulnerability in bacnet-stack prior to versions 1.4.6, 1.5.2, and 1.6.1 allows network hosts to join the BACnet/SC mesh without presenting a valid client certificate. This occurs because the server context is built with a CA certificate but does not enforce client certificate validation, enabling unauthorized TLS connections. The issue has been fixed in versions 1.4.6, 1.5.2, 1.6.1, and later.
CVE-2026-97692 is a high-severity out-of-bounds write vulnerability in the BACnet Stack open source protocol library for embedded systems. The flaw occurs in the BACnet/SC message decoder, which improperly processes header-option lists by following the MORE bit without bounds checking. This allows crafted frames to cause writes beyond the intended array, potentially corrupting adjacent memory. The vulnerability is exploitable before authentication from the first frame a peer sends. It affects versions prior to 1.4.6, between 1.5.0 and before 1.5.2, and between 1.6.0 and before 1.6.1. Fixed versions include 1.4.6, 1.5.2, and 1.6.1.
CVE-2026-102537 is a vulnerability in the bacnet-stack library affecting versions prior to 1.4.6, between 1.5.0 and before 1.5.2, and between 1.6.0 and before 1.6.1. The issue involves improper certificate validation in the bws_cli_connect() function, which accepts any self-signed certificate regardless of whether it chains to a trusted CA. This allows a BACnet/SC node to complete a TLS handshake with a rogue hub presenting a self-signed certificate, potentially exposing its identity and subsequent BACnet traffic to an attacker. The vulnerability has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
CVE-2026-100403 is a high-severity vulnerability in the BACnet Stack open source protocol library for embedded systems. The issue affects the BACnet/SC hub's Linux WebSocket server prior to versions 1.4.6, 1.5.2, and 1.6.1. It involves uncontrolled resource consumption due to unbounded growth of a fragment buffer when processing fragmented WebSocket messages. An attacker can cause the server to repeatedly reallocate memory by sending a stream of binary continuation fragments without a final frame, potentially exhausting system memory and causing a denial of service.
A high-severity out-of-bounds write vulnerability (CWE-787) exists in the BACnet Stack open source protocol library for embedded systems. Versions 1.4.0 up to but not including 1.4.6, 1.5.0 up to but not including 1.5.1, and 1.6.0 up to but not including 1.6.1 are affected. The issue occurs in the BACnet MS/TP receive path when decoding COBS frames, where the decode function can write past the end of the buffer due to incorrect capacity handling. This flaw has been fixed in versions 1.4.6, 1.5.1, 1.6.1, and 1.7.0.
CVE-2026-62977 is an improper access control vulnerability in the BACnet Stack open source protocol library prior to version 1.5.1. It allows remote attackers to change the size of a read-only RAMFS-backed stream-access FILE object without proper authorization. This can lead to exposure of uninitialized or stale memory contents when reading the enlarged file region, or unauthorized truncation of read-only content. The issue is fixed in versions 1.5.1 and later.
Astro versions up to 7.4.4 have a reflected or stored cross-site scripting (XSS) vulnerability via attribute injection in dynamic tag names. When a dynamic tag resolves to a string containing a slash (/), Astro's filtering failed to prevent injection of attributes, allowing crafted tag names like 'img/src/onerror=alert(1)' to render as elements with malicious attributes. This affects applications that use untrusted input directly as element names. The issue is fixed in Astro 7.4.5, which properly restricts dynamic tag names to valid element names and throws errors for invalid ones.
An out-of-bounds read vulnerability exists in bacnet-stack versions prior to 1.5.1. The issue arises from the RAMFS-backed FILE object implementation where record-counting logic incorrectly reads beyond the allocated heap buffer during consecutive AtomicWriteFile append requests. This flaw has been fixed in version 1.5.1.
CVE-2026-62975 is a medium severity vulnerability in the bacnet-stack open source BACnet protocol stack library. Versions prior to 1.5.1 contain a heap out-of-bounds read flaw in the RAMFS-backed FILE implementation when processing AtomicWriteFile requests that replace existing records with shorter data. This occurs because the backend uses a stale length value after shrinking the heap allocation, leading to reading beyond the allocated buffer. The issue is fixed in version 1.5.1.
AutoMapper versions prior to 15.1.4 and from 16.0.0 up to but not including 16.3.0 contain an uncontrolled recursion vulnerability. This occurs because the type depth counter is incremented only after creating the destination object, allowing recursive mappings via constructor parameters to bypass the MaxDepth limit. An attacker can exploit this to cause a StackOverflowException that terminates the process. The issue is fixed in versions 15.1.4 and 16.3.0.
A path validation flaw in the /_image endpoint of the @astrojs/node adapter allows reading image files from directories that differ only by letter case from the build output directory on case-sensitive filesystems. This occurs because the path check was case-insensitive, permitting access to files outside the intended directory if a case-variant sibling directory exists. The issue affects astro versions from 5.14.3 up to 7.4.6 and is fixed in 7.4.7.
AutoMapper versions prior to 15.1.4 and from 16.0.0 up to but not including 16.3.0 contain an uncontrolled recursion vulnerability. This occurs when mapping polymorphic graphs or certain complex object types, potentially causing an uncatchable StackOverflowException that terminates the process. The issue is fixed in versions 15.1.4 and 16.3.0.