CVE-2026-128100 is a vulnerability in HashiCorp Vault Community and Enterprise editions where ACL policy deny rules were not explicitly applied to case variants of user and group names in certain authentication methods. This flaw allows an authenticated user with delegated permissions to modify protected users or groups by exploiting case-insensitivity handling, potentially leading to privilege escalation. The issue is fixed in Vault Community Edition 2.2.2 and Vault Enterprise versions 2.2.2, 1.21.14, and 1.19.25.
Kanbanz plugin for WordPress versions before 1.0.3 contains an authorization bypass vulnerability allowing authenticated Kanban Staff users to access and modify boards they do not belong to. This is due to missing access control checks in admin-ajax handlers, enabling attackers to manipulate board_id or task_id parameters arbitrarily. Exploitation can lead to unauthorized reading of sensitive task data, modification of status columns, subtasks, labels, comments, attachments, and task creation on other teams' boards. The issue is fixed in version 1.0.3.
CVE-2026-128123 is a vulnerability in SvelteKit framework versions 5.5.7 up to but not including 5.5.8 and 6.0.0-next.0 up to but not including 6.0.1, as well as versions >=3.0.0-next.0 <3.1.1 and <2.70.4. The issue occurs in the @sveltejs/adapter-node where an attempt to add a header to an immutable request causes the server to crash, resulting in a denial of service. This flaw is fixed in versions 5.5.8, 6.0.1, 3.1.1, and 2.70.4. The CVSS score is 5.9, indicating a medium severity impact primarily due to availability disruption.
A cross-site scripting (XSS) vulnerability exists in SvelteKit's @sveltejs/adapter-cloudflare from version 4.7.0 up to but not including 7.2.10 and from 8.0.0-next.0 up to but not including 8.0.2. The flaw allows attacker-influenced links crawled during prerendering to inject whitespace, control characters, wildcards, or placeholders into redirect paths. These paths are written into Cloudflare _redirects output without proper validation, enabling unintended routing rules that could redirect or expose requests beyond intended prerendered routes. The issue is fixed in versions 7.2.10 and 8.0.2.
CVE-2026-128121 affects SvelteKit framework versions prior to certain fixed releases. The vulnerability involves improper escaping of attacker-influenced links during prerendering, which can cause unintended interpretation of routing paths as regular expressions. This may lead to exposure of content or behavior outside the intended application paths. The issue is resolved in specific patched versions of @sveltejs/adapter-vercel and @sveltejs/adapter-static.
This is a Request for Comments (RFC) open for community review until December 11, 2026, proposing a design for a cloud mirror system searchable by AI assistants where the server never stores the user's encryption key. The design aims to enhance data confidentiality by encrypting messages client-side and limiting server knowledge to token hashes and encrypted keys. It acknowledges limitations such as potential key exposure on a compromised server, deterministic search tag leakage, and lack of end-to-end encryption with AI providers. The RFC solicits feedback on cryptographic design choices, key rotation, token lifetimes, attestation, and other architectural questions.
SvelteKit versions from 2.42.0 up to but not including 3.1.1 contain an inefficient algorithmic complexity vulnerability in the experimental remote functions feature. Specifically, parsing a specially crafted request with many form entries can cause quadratic synchronous work, blocking the event loop and resulting in a denial of service. This issue is resolved in version 3.1.1.
CVE-2026-128119 is an authorization flaw in SvelteKit versions from 2.60.1 up to but not including 3.1.1. The issue occurs when using the experimental remote functions flag, allowing separate non-exported query.batch functions to share the same generated identifier. This can cause arguments intended for one function to be passed to another, potentially disclosing sensitive function arguments. The vulnerability is fixed in version 3.1.1.
A path parsing flaw in Nuxt versions 4.6.0 through 4.6.3 allows an unauthenticated attacker to bypass server-side route controls by using request paths starting with double slashes (//). This causes server middleware and route rules keyed on normal paths (e.g., /admin) to be skipped, enabling unauthorized access to protected pages and skipping security headers or redirects. The issue is fixed in version 4.6.4.
SvelteKit versions from 3.0.0 up to but not including 3.1.1 contain a vulnerability where server-only modules imported via src/params.js could be bundled into client-side code. This exposure allows private environment values or other server secrets to be accessible in the client bundle. The issue is resolved in version 3.1.1.
The @opentelemetry/instrumentation-http package for Node.js versions >=0.204.0 and <0.222.0 improperly handles sensitive query parameters in incoming HTTP requests. While outgoing client spans redact sensitive URL query parameters, incoming server spans do not, resulting in raw query strings—including credentials like AWS presigned URLs, Azure SAS tokens, and GCS signed URLs—being recorded in plaintext in the url.query attribute. This sensitive information is then exported to the tracing backend, exposing valid credentials to anyone with access to telemetry data. The issue is patched in version 0.222.0, which redacts sensitive query parameters by default for incoming spans and introduces a redactedQueryParamsServer option for customization.
CVE-2026-128117 is a vulnerability in SvelteKit prior to versions 2.70.4 and 3.1.1 where an unhandled URIError exception can occur due to improper handling of invalid percent-encoded pathnames in the reroute hook. This can cause an adapter-node server to crash and result in a denial of service. The issue is fixed in versions 2.70.4 and 3.1.1.
FlowiseAI Flowise versions up to 3.1.4 contain a server-side request forgery (SSRF) vulnerability. Authenticated users with permissions to create or update chatflows or agentflows can bypass the Custom Function sandbox's SSRF protections by requiring specific module subpaths inside allowlisted packages. This bypass returns an unwrapped HTTP client that skips validation, allowing attackers to send arbitrary HTTP requests to internal network addresses or cloud metadata endpoints. This can lead to network mapping, credential disclosure, and unauthorized state changes on internal services.
CVE-2026-128116 is a cross-site scripting (XSS) vulnerability in SvelteKit, a web application framework. Versions prior to 2.70.4 and 3.1.1, when configured with router.resolution set to 'server', could misinterpret pathnames starting with // as protocol-relative module specifiers during client-side navigation. This flaw allows an attacker to craft a link that causes the server-side route resolution to import and execute JavaScript from an external origin in the user's browser. The vulnerability is fixed in versions 2.70.4 and 3.1.1.
A vulnerability in dnspython prior to version 2.9.2 allows an attacker to cause uncontrolled resource consumption via the from_text() parser for WKS records. The parser does not validate that the service number is within the valid range (0 to 65535), enabling an attacker to supply a larger number that causes excessive memory and CPU usage, potentially terminating the process. This affects applications parsing attacker-controlled zone-file text with WKS records. The issue is fixed in dnspython version 2.9.2.
CVE-2026-68905 is a vulnerability in the lanshi17 hugo_blog project where three HTTP endpoints exposed by the AI assistant proxy lack authentication. This allows unauthenticated remote attackers to send arbitrary requests that are forwarded to upstream APIs using the operator's server-side API keys, potentially leading to quota exhaustion and service disruption. No patches are available at the time of publication.
AutoMapper versions prior to 16.3.0 and before 15.1.4 have a vulnerability where the MaxDepth recursion limit is not enforced when mapping destination types constructed via constructor parameters, such as positional records. This leads to uncontrolled recursion and a StackOverflowException that terminates the process. The flaw bypasses the MaxDepth mitigation introduced for a related vulnerability (CVE-2026-32933).
A vulnerability in the russh SSH client library allows a malicious SSH server, whose host key is ultimately rejected, to trigger the client's kex_done() callback with the raw key-exchange shared secret before server host-key verification occurs. This callback is intended for protocol bridging such as VPN-over-SSH or secondary encrypted channels. Because kex_done() runs before check_server_key(), an untrusted server can cause application-defined actions based on the shared secret even though the connection is later rejected.
LearnPress Course Wishlist Add-on versions before 4.1.2 contain an insecure direct object reference vulnerability. This flaw allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback. The vulnerability is exploitable via a publicly accessible REST route that requires only a public wp_rest nonce, enabling attackers to add or remove courses from any user's wishlist and enumerate wishlist status by iterating user_id and course_id values. The issue is fixed in version 4.1.2.
Budget Board versions prior to 3.6.2 have an improper authentication vulnerability in their OIDC login flow. The app signs into existing local accounts based solely on the email address from the identity provider's token without verifying the email ownership via the email_verified claim. This flaw allows an attacker to register with a victim's email on the OIDC provider and gain unauthorized access to the victim's Budget Board account, including sensitive linked bank data. The issue is fixed in version 3.6.2.