This is a Request for Comments (RFC) open for community review until December 11, 2026, proposing a design for a cloud mirror system searchable by AI assistants where the server never stores the user's encryption key. The design aims to enhance data confidentiality by encrypting messages client-side and limiting server knowledge to token hashes and encrypted keys. It acknowledges limitations such as potential key exposure on a compromised server, deterministic search tag leakage, and lack of end-to-end encryption with AI providers. The RFC solicits feedback on cryptographic design choices, key rotation, token lifetimes, attestation, and other architectural questions.
SvelteKit versions from 2.42.0 up to but not including 3.1.1 contain an inefficient algorithmic complexity vulnerability in the experimental remote functions feature. Specifically, parsing a specially crafted request with many form entries can cause quadratic synchronous work, blocking the event loop and resulting in a denial of service. This issue is resolved in version 3.1.1.
CVE-2026-128119 is an authorization flaw in SvelteKit versions from 2.60.1 up to but not including 3.1.1. The issue occurs when using the experimental remote functions flag, allowing separate non-exported query.batch functions to share the same generated identifier. This can cause arguments intended for one function to be passed to another, potentially disclosing sensitive function arguments. The vulnerability is fixed in version 3.1.1.
A path parsing flaw in Nuxt versions 4.6.0 through 4.6.3 allows an unauthenticated attacker to bypass server-side route controls by using request paths starting with double slashes (//). This causes server middleware and route rules keyed on normal paths (e.g., /admin) to be skipped, enabling unauthorized access to protected pages and skipping security headers or redirects. The issue is fixed in version 4.6.4.
SvelteKit versions from 3.0.0 up to but not including 3.1.1 contain a vulnerability where server-only modules imported via src/params.js could be bundled into client-side code. This exposure allows private environment values or other server secrets to be accessible in the client bundle. The issue is resolved in version 3.1.1.
The @opentelemetry/instrumentation-http package for Node.js versions >=0.204.0 and <0.222.0 improperly handles sensitive query parameters in incoming HTTP requests. While outgoing client spans redact sensitive URL query parameters, incoming server spans do not, resulting in raw query strings—including credentials like AWS presigned URLs, Azure SAS tokens, and GCS signed URLs—being recorded in plaintext in the url.query attribute. This sensitive information is then exported to the tracing backend, exposing valid credentials to anyone with access to telemetry data. The issue is patched in version 0.222.0, which redacts sensitive query parameters by default for incoming spans and introduces a redactedQueryParamsServer option for customization.
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, the reroute hook could rewrite an invalid percent-encoded pathname into a valid route and reach a comparison that decoded the original malformed pathname outside the guarded decoding operation. The resulting unhandled URIError could crash an adapter-node server and deny service to other requests. This issue is fixed in 2.70.4 and 3.1.1.
FlowiseAI Flowise versions up to 3.1.4 contain a server-side request forgery (SSRF) vulnerability. Authenticated users with permissions to create or update chatflows or agentflows can bypass the Custom Function sandbox's SSRF protections by requiring specific module subpaths inside allowlisted packages. This bypass returns an unwrapped HTTP client that skips validation, allowing attackers to send arbitrary HTTP requests to internal network addresses or cloud metadata endpoints. This can lead to network mapping, credential disclosure, and unauthorized state changes on internal services.
CVE-2026-128116 is a cross-site scripting (XSS) vulnerability in SvelteKit, a web application framework. Versions prior to 2.70.4 and 3.1.1, when configured with router.resolution set to 'server', could misinterpret pathnames starting with // as protocol-relative module specifiers during client-side navigation. This flaw allows an attacker to craft a link that causes the server-side route resolution to import and execute JavaScript from an external origin in the user's browser. The vulnerability is fixed in versions 2.70.4 and 3.1.1.
A vulnerability in dnspython prior to version 2.9.2 allows an attacker to cause uncontrolled resource consumption via the from_text() parser for WKS records. The parser does not validate that the service number is within the valid range (0 to 65535), enabling an attacker to supply a larger number that causes excessive memory and CPU usage, potentially terminating the process. This affects applications parsing attacker-controlled zone-file text with WKS records. The issue is fixed in dnspython version 2.9.2.
CVE-2026-68905 is a vulnerability in the lanshi17 hugo_blog project where three HTTP endpoints exposed by the AI assistant proxy lack authentication. This allows unauthenticated remote attackers to send arbitrary requests that are forwarded to upstream APIs using the operator's server-side API keys, potentially leading to quota exhaustion and service disruption. No patches are available at the time of publication.
AutoMapper versions prior to 16.3.0 and before 15.1.4 have a vulnerability where the MaxDepth recursion limit is not enforced when mapping destination types constructed via constructor parameters, such as positional records. This leads to uncontrolled recursion and a StackOverflowException that terminates the process. The flaw bypasses the MaxDepth mitigation introduced for a related vulnerability (CVE-2026-32933).
A vulnerability in the russh SSH client library allows a malicious SSH server, whose host key is ultimately rejected, to trigger the client's kex_done() callback with the raw key-exchange shared secret before server host-key verification occurs. This callback is intended for protocol bridging such as VPN-over-SSH or secondary encrypted channels. Because kex_done() runs before check_server_key(), an untrusted server can cause application-defined actions based on the shared secret even though the connection is later rejected.
LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead of relying on the session identity. Attackers can exploit the publicly accessible load_content_via_ajax REST route, which only requires a public wp_rest nonce, to add or remove courses from any user's wishlist and determine whether a given course is wishlisted by iterating user_id and course_id values.
Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provider's token - it never checks the standard email_verified claim. If the configured OIDC provider ever allows a user to register or display an email address without proving they own it , an attacker can register there using a victim's email and get signed into the victim's existing Budget Board account - including all their linked bank data. This issue has been patched in version 3.6.2.
OpenTelemetry-Go versions from 1.0.0-RC1 up to but not including 1.47.0 contain a vulnerability in the baggage metadata parsing implementation. The library eagerly materializes W3C baggage properties during parsing, causing bounded but disproportionate memory allocation amplification when processing densely populated headers. This can lead to increased memory allocation and garbage collection pressure, especially on services that enable baggage propagation and extract attacker-controlled context before authentication. The issue does not reliably cause out-of-memory conditions or complete denial of service. The vulnerability is fixed in version 1.47.0 by introducing lazy materialization of properties and in-place validation and normalization.
CVE-2026-128088 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Eugeny russh Rust SSH client and server library. The flaw exists in versions >=0.65.0 and <0.65.1 where the try_sign() function captures a private key reference before awaiting a confirmation step but does not revalidate the lock state afterward. This allows a remote SSH server using agent forwarding to bypass the current lock state during a signature request. The issue is fixed in version 0.65.1.
CVE-2026-129217 is an out-of-bounds read vulnerability in FRRouting versions 8.3 through 10.5.1. The flaw occurs in the bgp_notify_decapsulate_hard_reset() function when processing a BGP NOTIFICATION Cease/Hard Reset message with a one-byte data field. This causes a heap buffer over-read and an assertion failure, leading to a crash of the bgpd daemon and denial of service by terminating all BGP sessions. The issue is fixed in versions 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2, and 10.6.0.
PolicyPress, a compliance policy management tool, had a vulnerability prior to version 1.4.1 where sensitive information could be exposed due to CSS-only web redaction and insecure workflow defaults. This issue was addressed and fixed in version 1.4.1. The vulnerability has a medium severity rating with a CVSS score of 5.2.