CVE-2026-128130 is a vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.4 that run without the standard C-extension wheel or use AIOHTTP_NO_EXTENSIONS are affected. The issue arises when the pipelined request queue is full, causing the pure-Python parser to store unparsed data and return it to the caller. This leads to repeated processing of already-handled requests and excessive memory consumption. The vulnerability is fixed in version 3.14.4.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can stream data behind an upgrade request to a handler that does not immediately accept or reject the upgrade and cause unbounded memory consumption. This issue is fixed in version 3.14.4.
CVE-2026-128128 is a vulnerability in aiohttp versions prior to 3.14.4 where the C WebSocket reader uses signed 64-bit arithmetic to add a declared frame length to an already buffered partial message size. This can cause an integer overflow near 2^63, bypassing the max_msg_size check and allowing a remote attacker to cause unbounded memory consumption by sending a small non-final fragment followed by an oversized message. The Python WebSocket reader is not affected. The issue is fixed in version 3.14.4.
Tornado versions prior to 6.6.1 contain an open redirect vulnerability due to inconsistent URL parsing between browsers and Python's urllib. This discrepancy allows URLs starting with three or more slashes to bypass the redirect protections fixed in version 6.6.0. The issue is addressed in Tornado 6.6.1, which improves detection and fixes a regression from the previous fix.
CVE-2026-128127 is a high-severity vulnerability in aiohttp prior to version 3.14.4. The issue occurs in BodyPartReader.read_chunk() when processing multipart parts with Content-Transfer-Encoding set to base64. The function reads until the chunk length is a multiple of four without enforcing a byte limit, which can lead to uncontrolled resource consumption. This allows a remote attacker to send specially crafted multipart requests that bypass client_max_size limits, potentially causing excessive memory use or event loop spinning. The vulnerability is fixed in aiohttp version 3.14.4.
CVE-2026-128126 is a high-severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.4 have an inefficient algorithmic complexity issue in the Request.post() method, where the number of fields in a URL-encoded form body is not limited. This causes quadratic time complexity when inserting many repeated keys into MultiDict, potentially allowing a remote attacker to block the event loop by sending a specially crafted form POST request. The issue is fixed in aiohttp version 3.14.4.
Dolibarr versions prior to 24.0.2 have an insecure direct object reference vulnerability in the REST Documents API for the ticket module. Authenticated API users with ticket read permission can access attachments of tickets belonging to other companies by bypassing company-scope checks that are only applied during public ticket authentication, which REST API authentication does not perform. This allows enumeration of ticket identifiers and unauthorized retrieval of sensitive documents such as invoices and contracts.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client accumulate a very large cookie set, consume memory and CPU repeatedly across redirects, and construct an excessively large Cookie header for later requests to the same domain. This issue is fixed in version 3.14.4.
Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.
CVE-2026-128124 is a high-severity vulnerability in aiohttp versions prior to 3.14.4. The issue arises from inefficient regular expression handling in Application.add_domain(), where multiple asterisk wildcards in domain masks lead to polynomial-time processing of certain Host headers. This can allow a remote attacker to stall the event loop by sending crafted headers, causing a denial of service. The vulnerability is fixed in aiohttp version 3.14.4.
A vulnerability in dnspython versions prior to 2.9.2 allows a maliciously crafted zone file containing a WKS record with an out-of-range service number to cause excessive memory and CPU consumption. This can lead to denial of service by exhausting system resources during parsing.
- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, and Johnson Controls FX90 allows CAPEC‑17: Accessing, Modifying or Deleting Files.
This issue affects FX Server: before 14.10.10 and before 14.14.1; FX80: before 14.14.10 and before 14.14.1; FX90: before 14.10.10 and before 14.14.1.
Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
Kanbanz plugin for WordPress versions before 1.0.3 contains an authorization bypass vulnerability allowing authenticated Kanban Staff users to access and modify boards they do not belong to. This is due to missing access control checks in admin-ajax handlers, enabling attackers to manipulate board_id or task_id parameters arbitrarily. Exploitation can lead to unauthorized reading of sensitive task data, modification of status columns, subtasks, labels, comments, attachments, and task creation on other teams' boards. The issue is fixed in version 1.0.3.
CVE-2026-128123 is a vulnerability in SvelteKit framework versions 5.5.7 up to but not including 5.5.8 and 6.0.0-next.0 up to but not including 6.0.1, as well as versions >=3.0.0-next.0 <3.1.1 and <2.70.4. The issue occurs in the @sveltejs/adapter-node where an attempt to add a header to an immutable request causes the server to crash, resulting in a denial of service. This flaw is fixed in versions 5.5.8, 6.0.1, 3.1.1, and 2.70.4. The CVSS score is 5.9, indicating a medium severity impact primarily due to availability disruption.
The PyPI package 'qap793gl4l' version 0.1.1 is part of a malicious campaign that executes remote code. It overrides the install command in its setup.py to run malicious code during installation, including downloading and executing a remote malicious script. The campaign is identified as having clear malicious intent, such as infostealing.
A cross-site scripting (XSS) vulnerability exists in SvelteKit's @sveltejs/adapter-cloudflare from version 4.7.0 up to but not including 7.2.10 and from 8.0.0-next.0 up to but not including 8.0.2. The flaw allows attacker-influenced links crawled during prerendering to inject whitespace, control characters, wildcards, or placeholders into redirect paths. These paths are written into Cloudflare _redirects output without proper validation, enabling unintended routing rules that could redirect or expose requests beyond intended prerendered routes. The issue is fixed in versions 7.2.10 and 8.0.2.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be emitted into the generated Vercel routing configuration without escaping regular-expression metacharacters. The configuration could consequently interpret the path as regular-expression syntax, match unintended application paths, and expose content or behavior outside the intended path. This issue is fixed in @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1.