The PyPI package 'qap793gl4l' version 0.1.1 is part of a malicious campaign that executes remote code. It overrides the install command in its setup.py to run malicious code during installation, including downloading and executing a remote malicious script. The campaign is identified as having clear malicious intent, such as infostealing.
A cross-site scripting (XSS) vulnerability exists in SvelteKit's @sveltejs/adapter-cloudflare from version 4.7.0 up to but not including 7.2.10 and from 8.0.0-next.0 up to but not including 8.0.2. The flaw allows attacker-influenced links crawled during prerendering to inject whitespace, control characters, wildcards, or placeholders into redirect paths. These paths are written into Cloudflare _redirects output without proper validation, enabling unintended routing rules that could redirect or expose requests beyond intended prerendered routes. The issue is fixed in versions 7.2.10 and 8.0.2.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be emitted into the generated Vercel routing configuration without escaping regular-expression metacharacters. The configuration could consequently interpret the path as regular-expression syntax, match unintended application paths, and expose content or behavior outside the intended path. This issue is fixed in @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1.
This is a Request for Comments (RFC) open for community review until December 11, 2026, proposing a design for a cloud mirror system searchable by AI assistants where the server never stores the user's encryption key. The design aims to enhance data confidentiality by encrypting messages client-side and limiting server knowledge to token hashes and encrypted keys. It acknowledges limitations such as potential key exposure on a compromised server, deterministic search tag leakage, and lack of end-to-end encryption with AI providers. The RFC solicits feedback on cryptographic design choices, key rotation, token lifetimes, attestation, and other architectural questions.
SvelteKit versions from 2.42.0 up to but not including 3.1.1 contain an inefficient algorithmic complexity vulnerability in the experimental remote functions feature. Specifically, parsing a specially crafted request with many form entries can cause quadratic synchronous work, blocking the event loop and resulting in a denial of service. This issue is resolved in version 3.1.1.
CVE-2026-128119 is an authorization flaw in SvelteKit versions from 2.60.1 up to but not including 3.1.1. The issue occurs when using the experimental remote functions flag, allowing separate non-exported query.batch functions to share the same generated identifier. This can cause arguments intended for one function to be passed to another, potentially disclosing sensitive function arguments. The vulnerability is fixed in version 3.1.1.
A path parsing flaw in Nuxt versions 4.6.0 through 4.6.3 allows an unauthenticated attacker to bypass server-side route controls by using request paths starting with double slashes (//). This causes server middleware and route rules keyed on normal paths (e.g., /admin) to be skipped, enabling unauthorized access to protected pages and skipping security headers or redirects. The issue is fixed in version 4.6.4.
SvelteKit versions from 3.0.0 up to but not including 3.1.1 contain a vulnerability where server-only modules imported via src/params.js could be bundled into client-side code. This exposure allows private environment values or other server secrets to be accessible in the client bundle. The issue is resolved in version 3.1.1.
The @opentelemetry/instrumentation-http package for Node.js versions >=0.204.0 and <0.222.0 improperly handles sensitive query parameters in incoming HTTP requests. While outgoing client spans redact sensitive URL query parameters, incoming server spans do not, resulting in raw query strings—including credentials like AWS presigned URLs, Azure SAS tokens, and GCS signed URLs—being recorded in plaintext in the url.query attribute. This sensitive information is then exported to the tracing backend, exposing valid credentials to anyone with access to telemetry data. The issue is patched in version 0.222.0, which redacts sensitive query parameters by default for incoming spans and introduces a redactedQueryParamsServer option for customization.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, the reroute hook could rewrite an invalid percent-encoded pathname into a valid route and reach a comparison that decoded the original malformed pathname outside the guarded decoding operation. The resulting unhandled URIError could crash an adapter-node server and deny service to other requests. This issue is fixed in 2.70.4 and 3.1.1.
FlowiseAI Flowise versions up to 3.1.4 contain a server-side request forgery (SSRF) vulnerability. Authenticated users with permissions to create or update chatflows or agentflows can bypass the Custom Function sandbox's SSRF protections by requiring specific module subpaths inside allowlisted packages. This bypass returns an unwrapped HTTP client that skips validation, allowing attackers to send arbitrary HTTP requests to internal network addresses or cloud metadata endpoints. This can lead to network mapping, credential disclosure, and unauthorized state changes on internal services.
CVE-2026-128116 is a cross-site scripting (XSS) vulnerability in SvelteKit, a web application framework. Versions prior to 2.70.4 and 3.1.1, when configured with router.resolution set to 'server', could misinterpret pathnames starting with // as protocol-relative module specifiers during client-side navigation. This flaw allows an attacker to craft a link that causes the server-side route resolution to import and execute JavaScript from an external origin in the user's browser. The vulnerability is fixed in versions 2.70.4 and 3.1.1.
A vulnerability in dnspython prior to version 2.9.2 allows an attacker to cause uncontrolled resource consumption via the from_text() parser for WKS records. The parser does not validate that the service number is within the valid range (0 to 65535), enabling an attacker to supply a larger number that causes excessive memory and CPU usage, potentially terminating the process. This affects applications parsing attacker-controlled zone-file text with WKS records. The issue is fixed in dnspython version 2.9.2.
CVE-2026-68905 is a vulnerability in the lanshi17 hugo_blog project where three HTTP endpoints exposed by the AI assistant proxy lack authentication. This allows unauthenticated remote attackers to send arbitrary requests that are forwarded to upstream APIs using the operator's server-side API keys, potentially leading to quota exhaustion and service disruption. No patches are available at the time of publication.
AutoMapper versions prior to 16.3.0 and before 15.1.4 have a vulnerability where the MaxDepth recursion limit is not enforced when mapping destination types constructed via constructor parameters, such as positional records. This leads to uncontrolled recursion and a StackOverflowException that terminates the process. The flaw bypasses the MaxDepth mitigation introduced for a related vulnerability (CVE-2026-32933).
A vulnerability in the russh SSH client library allows a malicious SSH server, whose host key is ultimately rejected, to trigger the client's kex_done() callback with the raw key-exchange shared secret before server host-key verification occurs. This callback is intended for protocol bridging such as VPN-over-SSH or secondary encrypted channels. Because kex_done() runs before check_server_key(), an untrusted server can cause application-defined actions based on the shared secret even though the connection is later rejected.
LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load_content_via_ajax REST route, which only requires a public wp_rest nonce, to add or remove courses from any user's wishlist and determine whether a given course is wishlisted by iterating user_id and course_id values.
Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provider's token - it never checks the standard email_verified claim. If the configured OIDC provider ever allows a user to register or display an email address without proving they own it , an attacker can register there using a victim's email and get signed into the victim's existing Budget Board account - including all their linked bank data. This issue has been patched in version 3.6.2.
In russh version 0.65.0, a time-of-check to time-of-use (TOCTOU) vulnerability exists in the agent's asynchronous confirmation process. A sign request for a confirmation-constrained key can complete signing after the agent has been locked by another connection, bypassing the lock state. This occurs because the private key is cloned and held across an await point without revalidating the lock state after confirmation. The flaw violates RFC 9987 section 5.7, which requires suspending private-key signature operations while the agent is locked. The issue is fixed in version 0.65.1.
OpenTelemetry-Go versions from 1.0.0-RC1 up to but not including 1.47.0 contain a vulnerability in the baggage metadata parsing implementation. The library eagerly materializes W3C baggage properties during parsing, causing bounded but disproportionate memory allocation amplification when processing densely populated headers. This can lead to increased memory allocation and garbage collection pressure, especially on services that enable baggage propagation and extract attacker-controlled context before authentication. The issue does not reliably cause out-of-memory conditions or complete denial of service. The vulnerability is fixed in version 1.47.0 by introducing lazy materialization of properties and in-place validation and normalization.