PolicyPress, a compliance policy management tool, had a vulnerability prior to version 1.4.1 where sensitive information could be exposed due to CSS-only web redaction and insecure workflow defaults. This issue was addressed and fixed in version 1.4.1. The vulnerability has a medium severity rating with a CVSS score of 5.2.
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kex_done() with the raw shared secret before check_server_key() accepts the server host key or certificate. A malicious SSH server can therefore trigger application-defined secondary-channel initialization or early data handling even when the server identity is subsequently rejected. Ordinary clients that keep the callback's no-op default or independently defer callback-derived actions until trust is confirmed are not affected. This issue is fixed in version 0.65.1.
CVE-2026-67444 is a cross-site scripting (XSS) vulnerability in knrdl's hubleys-dashboard prior to version 0.5.2. Authenticated non-admin users could upload files with arbitrary extensions as dashboard background images, including .html files. These files are served with a Content-Type based on the file extension without applying the app's Content-Security-Policy, allowing embedded scripts to run unrestricted. This issue has been fixed in version 0.5.2.
CVE-2026-68510 affects the contain-rs bit-vec library prior to version 0.10.0. The vulnerability involves improper input validation leading to undefined behavior when deserializing BitVec data from untrusted sources and subsequently using unsafe get_unchecked operations. This can cause incorrect behavior in applications using the affected versions. The issue is fixed in version 0.10.0.
CVE-2026-128086 is a medium severity vulnerability in the open-telemetry opentelemetry-go library affecting versions from 1.0.0-RC1 up to but not including 1.47.0. The issue involves uncontrolled resource consumption caused by the eager materialization of every W3C baggage property during baggage parsing and extraction. This can lead to increased memory allocation and garbage collection pressure when processing densely populated baggage headers. Remote exploitation requires that baggage extraction be enabled, attacker-controlled input reaches the extraction process, and that extraction occurs before authentication or on a public route. The vulnerability does not reliably cause process termination. The issue is fixed in version 1.47.0.
CVE-2026-128085 is a vulnerability in the open-telemetry opentelemetry-go SDK affecting versions from 0.9.0, 1.33.0, and 1.35.0 up to but not including 1.47.0. The issue involves incorrect calculation of multi-byte string length where valid U+FFFD replacement characters are not counted in truncation logic. This allows attacker-controlled telemetry attributes to exceed configured memory and character limits, increasing memory retention and pipeline pressure. The vulnerability does not affect confidentiality or integrity. It is fixed in version 1.47.0.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighting.c), reachable pre-authentication through two default-registered service handlers: the UnconfirmedRequest WriteGroup service (0x0A) and Confirmed WriteProperty on a BACnetXYColor-typed property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
The npm package 'kampodra' version 0.8.16 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have gained full control of the system.
A numeric type conversion flaw in sqlite3-ruby prior to version 2.10.2 causes string lengths to be cast to int on 64-bit platforms. This can truncate SQL strings or bound values larger than 4 GiB, potentially dropping trailing SQL clauses such as WHERE conditions. If a dropped clause contained a bind placeholder, an exception is raised instead of executing the query. The issue is fixed in version 2.10.2.
AutoMapper versions prior to 16.3.0 and before 15.1.4 contain a denial of service vulnerability due to uncontrolled recursion that bypasses the MaxDepth limit. This flaw affects polymorphic maps, runtime-typed members, dictionary and dynamic sources, and recursive type converters, allowing deeply nested attacker-controlled data to cause a StackOverflowException and crash the application. The issue is fixed in versions 16.3.0 and 15.1.4.
CVE-2026-128083 is a deserialization vulnerability in the Laravel framework's Concurrency::run process driver prior to versions 12.71.0 and 13.40.0. Under specific application conditions where untrusted input is routed into task output, an attacker can forge an internal result message by injecting a crafted JSON document followed by gzip bytes into a child process's standard output. This can lead to remote code execution. The vulnerability is not exposed by default and requires particular application code patterns. It is fixed in Laravel versions 12.71.0 and 13.40.0.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.6.1, there is a server-side denial-of-service issue affecting the Structured View object implementation. This issue has been patched in versions 1.6.1 and 1.7.0.
A vulnerability in bacnet-stack prior to versions 1.4.6, 1.5.2, and 1.6.1 allows network hosts to join the BACnet/SC mesh without presenting a valid client certificate. This occurs because the server context is built with a CA certificate but does not enforce client certificate validation, enabling unauthorized TLS connections. The issue has been fixed in versions 1.4.6, 1.5.2, 1.6.1, and later.
The hauntview npm package version 0.2.9 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
CVE-2026-97692 is a high-severity out-of-bounds write vulnerability in the BACnet Stack open source protocol library for embedded systems. The flaw occurs in the BACnet/SC message decoder, which improperly processes header-option lists by following the MORE bit without bounds checking. This allows crafted frames to cause writes beyond the intended array, potentially corrupting adjacent memory. The vulnerability is exploitable before authentication from the first frame a peer sends. It affects versions prior to 1.4.6, between 1.5.0 and before 1.5.2, and between 1.6.0 and before 1.6.1. Fixed versions include 1.4.6, 1.5.2, and 1.6.1.
CVE-2026-102537 is a vulnerability in the bacnet-stack library affecting versions prior to 1.4.6, between 1.5.0 and before 1.5.2, and between 1.6.0 and before 1.6.1. The issue involves improper certificate validation in the bws_cli_connect() function, which accepts any self-signed certificate regardless of whether it chains to a trusted CA. This allows a BACnet/SC node to complete a TLS handshake with a rogue hub presenting a self-signed certificate, potentially exposing its identity and subsequent BACnet traffic to an attacker. The vulnerability has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.
CVE-2026-100403 is a high-severity vulnerability in the BACnet Stack open source protocol library for embedded systems. The issue affects the BACnet/SC hub's Linux WebSocket server prior to versions 1.4.6, 1.5.2, and 1.6.1. It involves uncontrolled resource consumption due to unbounded growth of a fragment buffer when processing fragmented WebSocket messages. An attacker can cause the server to repeatedly reallocate memory by sending a stream of binary continuation fragments without a final frame, potentially exhausting system memory and causing a denial of service.