AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client accumulate a very large cookie set, consume memory and CPU repeatedly across redirects, and construct an excessively large Cookie header for later requests to the same domain. This issue is fixed in version 3.14.4.
Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.add_domain() converts every asterisk wildcard in a domain mask into a greedy regular-expression fragment, so a mask containing two or more wildcards can take polynomial time to reject a long Host header that does not match. A remote attacker can repeatedly send such headers to a server configured with a multi-wildcard domain mask and stall the event loop. This issue is fixed in version 3.14.4.
- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, and Johnson Controls FX90 allows CAPEC‑17: Accessing, Modifying or Deleting Files.
This issue affects FX Server: before 14.10.10 and before 14.14.1; FX80: before 14.14.10 and before 14.14.1; FX90: before 14.10.10 and before 14.14.1.
CVE-2026-128100 is a vulnerability in HashiCorp Vault Community and Enterprise editions where ACL policy deny rules were not explicitly applied to case variants of user and group names in certain authentication methods. This flaw allows an authenticated user with delegated permissions to modify protected users or groups by exploiting case-insensitivity handling, potentially leading to privilege escalation. The issue is fixed in Vault Community Edition 2.2.2 and Vault Enterprise versions 2.2.2, 1.21.14, and 1.19.25.
Kanbanz plugin for WordPress versions before 1.0.3 contains an authorization bypass vulnerability allowing authenticated Kanban Staff users to access and modify boards they do not belong to. This is due to missing access control checks in admin-ajax handlers, enabling attackers to manipulate board_id or task_id parameters arbitrarily. Exploitation can lead to unauthorized reading of sensitive task data, modification of status columns, subtasks, labels, comments, attachments, and task creation on other teams' boards. The issue is fixed in version 1.0.3.
CVE-2026-128123 is a vulnerability in SvelteKit framework versions 5.5.7 up to but not including 5.5.8 and 6.0.0-next.0 up to but not including 6.0.1, as well as versions >=3.0.0-next.0 <3.1.1 and <2.70.4. The issue occurs in the @sveltejs/adapter-node where an attempt to add a header to an immutable request causes the server to crash, resulting in a denial of service. This flaw is fixed in versions 5.5.8, 6.0.1, 3.1.1, and 2.70.4. The CVSS score is 5.9, indicating a medium severity impact primarily due to availability disruption.
A cross-site scripting (XSS) vulnerability exists in SvelteKit's @sveltejs/adapter-cloudflare from version 4.7.0 up to but not including 7.2.10 and from 8.0.0-next.0 up to but not including 8.0.2. The flaw allows attacker-influenced links crawled during prerendering to inject whitespace, control characters, wildcards, or placeholders into redirect paths. These paths are written into Cloudflare _redirects output without proper validation, enabling unintended routing rules that could redirect or expose requests beyond intended prerendered routes. The issue is fixed in versions 7.2.10 and 8.0.2.
CVE-2026-128121 affects SvelteKit framework versions prior to certain fixed releases. The vulnerability involves improper escaping of attacker-influenced links during prerendering, which can cause unintended interpretation of routing paths as regular expressions. This may lead to exposure of content or behavior outside the intended application paths. The issue is resolved in specific patched versions of @sveltejs/adapter-vercel and @sveltejs/adapter-static.
This is a Request for Comments (RFC) open for community review until December 11, 2026, proposing a design for a cloud mirror system searchable by AI assistants where the server never stores the user's encryption key. The design aims to enhance data confidentiality by encrypting messages client-side and limiting server knowledge to token hashes and encrypted keys. It acknowledges limitations such as potential key exposure on a compromised server, deterministic search tag leakage, and lack of end-to-end encryption with AI providers. The RFC solicits feedback on cryptographic design choices, key rotation, token lifetimes, attestation, and other architectural questions.
SvelteKit versions from 2.42.0 up to but not including 3.1.1 contain an inefficient algorithmic complexity vulnerability in the experimental remote functions feature. Specifically, parsing a specially crafted request with many form entries can cause quadratic synchronous work, blocking the event loop and resulting in a denial of service. This issue is resolved in version 3.1.1.
CVE-2026-128119 is an authorization flaw in SvelteKit versions from 2.60.1 up to but not including 3.1.1. The issue occurs when using the experimental remote functions flag, allowing separate non-exported query.batch functions to share the same generated identifier. This can cause arguments intended for one function to be passed to another, potentially disclosing sensitive function arguments. The vulnerability is fixed in version 3.1.1.
A path parsing flaw in Nuxt versions 4.6.0 through 4.6.3 allows an unauthenticated attacker to bypass server-side route controls by using request paths starting with double slashes (//). This causes server middleware and route rules keyed on normal paths (e.g., /admin) to be skipped, enabling unauthorized access to protected pages and skipping security headers or redirects. The issue is fixed in version 4.6.4.
SvelteKit versions from 3.0.0 up to but not including 3.1.1 contain a vulnerability where server-only modules imported via src/params.js could be bundled into client-side code. This exposure allows private environment values or other server secrets to be accessible in the client bundle. The issue is resolved in version 3.1.1.
The @opentelemetry/instrumentation-http package for Node.js versions >=0.204.0 and <0.222.0 improperly handles sensitive query parameters in incoming HTTP requests. While outgoing client spans redact sensitive URL query parameters, incoming server spans do not, resulting in raw query strings—including credentials like AWS presigned URLs, Azure SAS tokens, and GCS signed URLs—being recorded in plaintext in the url.query attribute. This sensitive information is then exported to the tracing backend, exposing valid credentials to anyone with access to telemetry data. The issue is patched in version 0.222.0, which redacts sensitive query parameters by default for incoming spans and introduces a redactedQueryParamsServer option for customization.
CVE-2026-128117 is a vulnerability in SvelteKit prior to versions 2.70.4 and 3.1.1 where an unhandled URIError exception can occur due to improper handling of invalid percent-encoded pathnames in the reroute hook. This can cause an adapter-node server to crash and result in a denial of service. The issue is fixed in versions 2.70.4 and 3.1.1.
FlowiseAI Flowise versions up to 3.1.4 contain a server-side request forgery (SSRF) vulnerability. Authenticated users with permissions to create or update chatflows or agentflows can bypass the Custom Function sandbox's SSRF protections by requiring specific module subpaths inside allowlisted packages. This bypass returns an unwrapped HTTP client that skips validation, allowing attackers to send arbitrary HTTP requests to internal network addresses or cloud metadata endpoints. This can lead to network mapping, credential disclosure, and unauthorized state changes on internal services.
CVE-2026-128116 is a cross-site scripting (XSS) vulnerability in SvelteKit, a web application framework. Versions prior to 2.70.4 and 3.1.1, when configured with router.resolution set to 'server', could misinterpret pathnames starting with // as protocol-relative module specifiers during client-side navigation. This flaw allows an attacker to craft a link that causes the server-side route resolution to import and execute JavaScript from an external origin in the user's browser. The vulnerability is fixed in versions 2.70.4 and 3.1.1.
A vulnerability in dnspython prior to version 2.9.2 allows an attacker to cause uncontrolled resource consumption via the from_text() parser for WKS records. The parser does not validate that the service number is within the valid range (0 to 65535), enabling an attacker to supply a larger number that causes excessive memory and CPU usage, potentially terminating the process. This affects applications parsing attacker-controlled zone-file text with WKS records. The issue is fixed in dnspython version 2.9.2.
CVE-2026-68905 is a vulnerability in the lanshi17 hugo_blog project where three HTTP endpoints exposed by the AI assistant proxy lack authentication. This allows unauthenticated remote attackers to send arbitrary requests that are forwarded to upstream APIs using the operator's server-side API keys, potentially leading to quota exhaustion and service disruption. No patches are available at the time of publication.