CVE-2026-128088 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Eugeny russh Rust SSH client and server library. The flaw exists in versions >=0.65.0 and <0.65.1 where the try_sign() function captures a private key reference before awaiting a confirmation step but does not revalidate the lock state afterward. This allows a remote SSH server using agent forwarding to bypass the current lock state during a signature request. The issue is fixed in version 0.65.1.
CVE-2026-129217 is an out-of-bounds read vulnerability in FRRouting versions 8.3 through 10.5.1. The flaw occurs in the bgp_notify_decapsulate_hard_reset() function when processing a BGP NOTIFICATION Cease/Hard Reset message with a one-byte data field. This causes a heap buffer over-read and an assertion failure, leading to a crash of the bgpd daemon and denial of service by terminating all BGP sessions. The issue is fixed in versions 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2, and 10.6.0.
PolicyPress, a compliance policy management tool, had a vulnerability prior to version 1.4.1 where sensitive information could be exposed due to CSS-only web redaction and insecure workflow defaults. This issue was addressed and fixed in version 1.4.1. The vulnerability has a medium severity rating with a CVSS score of 5.2.
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kex_done() with the raw shared secret before check_server_key() accepts the server host key or certificate. A malicious SSH server can therefore trigger application-defined secondary-channel initialization or early data handling even when the server identity is subsequently rejected. Ordinary clients that keep the callback's no-op default or independently defer callback-derived actions until trust is confirmed are not affected. This issue is fixed in version 0.65.1.
CVE-2026-67444 is a cross-site scripting (XSS) vulnerability in knrdl's hubleys-dashboard prior to version 0.5.2. Authenticated non-admin users could upload files with arbitrary extensions as dashboard background images, including .html files. These files are served with a Content-Type based on the file extension without applying the app's Content-Security-Policy, allowing embedded scripts to run unrestricted. This issue has been fixed in version 0.5.2.
CVE-2026-68510 affects the contain-rs bit-vec library prior to version 0.10.0. The vulnerability involves improper input validation leading to undefined behavior when deserializing BitVec data from untrusted sources and subsequently using unsafe get_unchecked operations. This can cause incorrect behavior in applications using the affected versions. The issue is fixed in version 0.10.0.
CVE-2026-128086 is a medium severity vulnerability in the open-telemetry opentelemetry-go library affecting versions from 1.0.0-RC1 up to but not including 1.47.0. The issue involves uncontrolled resource consumption caused by the eager materialization of every W3C baggage property during baggage parsing and extraction. This can lead to increased memory allocation and garbage collection pressure when processing densely populated baggage headers. Remote exploitation requires that baggage extraction be enabled, attacker-controlled input reaches the extraction process, and that extraction occurs before authentication or on a public route. The vulnerability does not reliably cause process termination. The issue is fixed in version 1.47.0.
CVE-2026-128085 is a vulnerability in the open-telemetry opentelemetry-go SDK affecting versions from 0.9.0, 1.33.0, and 1.35.0 up to but not including 1.47.0. The issue involves incorrect calculation of multi-byte string length where valid U+FFFD replacement characters are not counted in truncation logic. This allows attacker-controlled telemetry attributes to exceed configured memory and character limits, increasing memory retention and pipeline pressure. The vulnerability does not affect confidentiality or integrity. It is fixed in version 1.47.0.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighting.c), reachable pre-authentication through two default-registered service handlers: the UnconfirmedRequest WriteGroup service (0x0A) and Confirmed WriteProperty on a BACnetXYColor-typed property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
The npm package 'kampodra' version 0.8.16 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have gained full control of the system.
A numeric type conversion flaw in sqlite3-ruby prior to version 2.10.2 causes string lengths to be cast to int on 64-bit platforms. This can truncate SQL strings or bound values larger than 4 GiB, potentially dropping trailing SQL clauses such as WHERE conditions. If a dropped clause contained a bind placeholder, an exception is raised instead of executing the query. The issue is fixed in version 2.10.2.
AutoMapper versions prior to 16.3.0 and before 15.1.4 contain a denial of service vulnerability due to uncontrolled recursion that bypasses the MaxDepth limit. This flaw affects polymorphic maps, runtime-typed members, dictionary and dynamic sources, and recursive type converters, allowing deeply nested attacker-controlled data to cause a StackOverflowException and crash the application. The issue is fixed in versions 16.3.0 and 15.1.4.
CVE-2026-128083 is a deserialization vulnerability in the Laravel framework's Concurrency::run process driver prior to versions 12.71.0 and 13.40.0. Under specific application conditions where untrusted input is routed into task output, an attacker can forge an internal result message by injecting a crafted JSON document followed by gzip bytes into a child process's standard output. This can lead to remote code execution. The vulnerability is not exposed by default and requires particular application code patterns. It is fixed in Laravel versions 12.71.0 and 13.40.0.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.6.1, there is a server-side denial-of-service issue affecting the Structured View object implementation. This issue has been patched in versions 1.6.1 and 1.7.0.
A vulnerability in bacnet-stack prior to versions 1.4.6, 1.5.2, and 1.6.1 allows network hosts to join the BACnet/SC mesh without presenting a valid client certificate. This occurs because the server context is built with a CA certificate but does not enforce client certificate validation, enabling unauthorized TLS connections. The issue has been fixed in versions 1.4.6, 1.5.2, 1.6.1, and later.
The hauntview npm package version 0.2.9 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
CVE-2026-97692 is a high-severity out-of-bounds write vulnerability in the BACnet Stack open source protocol library for embedded systems. The flaw occurs in the BACnet/SC message decoder, which improperly processes header-option lists by following the MORE bit without bounds checking. This allows crafted frames to cause writes beyond the intended array, potentially corrupting adjacent memory. The vulnerability is exploitable before authentication from the first frame a peer sends. It affects versions prior to 1.4.6, between 1.5.0 and before 1.5.2, and between 1.6.0 and before 1.6.1. Fixed versions include 1.4.6, 1.5.2, and 1.6.1.