CVE-2026-97683

IBM Cyber Fraud includes components with multiple known vulnerabilities

IBM Cyber Fraud 1.0.0 through 1.1.0 could allow a local attacker to bypass security restrictions due to a missing or misconfigured security context.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Cyber Fraud

CVE-2026-9870

IBM Cyber Fraud includes components with multiple known vulnerabilities

IBM Cyber Fraud 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Cyber Fraud

CVE-2026-108290

IBM Cyber Fraud includes components with multiple known vulnerabilities

IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an attacker with local access to a container to extract sensitive information due to unrestrictive network policies.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Cyber Fraud

CVE-2026-9821

IBM Cyber Fraud includes components with multiple known vulnerabilities

IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Cyber Fraud

CVE-2026-128083

Laravel: Task Output Injection - Concurrency Process

Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a task must write attacker-controlled bytes at the start of the child's standard output that form a complete JSON document followed by gzip magic bytes. Under those application-specific conditions, an attacker can forge the internal result message and achieve remote code execution. The affected behavior is not exposed by default and requires application code that routes untrusted input into task output. This issue is fixed in versions 12.71.0 and 13.40.0.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Laravel

Products

Framework

CVE-2026-64675

BACnet Stack: Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighting.c), reachable pre-authentication through two default-registered service handlers: the UnconfirmedRequest WriteGroup service (0x0A) and Confirmed WriteProperty on a BACnetXYColor-typed property. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-128086

OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into internal/baggage.Item. A valid densely populated baggage header can therefore cause allocation traffic and retained memory disproportionate to its bounded input size. Remote impact requires baggage extraction to be enabled, attacker-controlled input to reach it, and extraction to run before authentication or on a public route; the evidence establishes increased allocation and garbage-collection pressure but not reliable process termination. This issue is fixed in version 1.47.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opentelemetry

Products

Opentelemetry-go

CVE-2026-129217

bgpd: out-of-bounds heap read and crash on NOTIFICATION Cease/Hard Reset with one data byte

In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message (RFC 8538). When the data field is exactly one byte long, the function reads one byte past the end of a heap buffer and the 16-bit length of the encapsulated data underflows to 65535, causing a 65535-byte out-of-bounds heap read followed by an assertion failure. A remote BGP peer that has established a session and negotiated the Graceful Restart capability with the Notification (N) bit can send such a message to crash the bgpd daemon, terminating all BGP sessions (denial of service). This is fixed in 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2 and 10.6.0.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Frrouting

Products

Frrouting

CVE-2026-128088

russh try_sign: asynchronous confirmation can sign after agent lock

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, try_sign() captures an Arc<PrivateKey> before awaiting Agent::confirm() and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in the remediation for CVE-2026-116794. A peer, including a remote SSH server using agent forwarding, can begin a confirmation-constrained signature request while the agent is unlocked and receive the signature after another connection locks the agent if the stale confirmation returns true. New post-lock requests are rejected and private key material is not disclosed, but the pending operation bypasses the current lock state. This issue is fixed in version 0.65.1.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Eugeny

Products

Russh

CVE-2026-128089

dnspython excessive memory and CPU use

dnspython is a DNS toolkit for Python. Prior to version 2.9.2, the from_text() parser for WKS records does not require the service number to be between 0 and 65535 before using it as a bitmap offset. An attacker-controlled zone file can supply a larger number, causing the service bitmap to grow to an extremely large size through inefficient repeated extension, consuming excessive memory and CPU and potentially terminating the process. Applications are affected only when they parse zone-file text whose record type and rdata are attacker controlled. This issue is fixed in version 2.9.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Rthalley

Products

Dnspython

CVE-2026-128116

SvelteKit: Protocol-relative module import during server-side route resolution allows cross-origin script execution

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, apps configured with router.resolution: 'server' could treat a pathname beginning with // as a protocol-relative module specifier during client-side navigation. A socially engineered link could therefore make server-side route resolution import and execute JavaScript from another origin in the user's browser. This issue is fixed in 2.70.4 and 3.1.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-128117

SvelteKit: Unhandled URIError when `reroute` rewrites a malformed pathname crashes adapter-node

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, the reroute hook could rewrite an invalid percent-encoded pathname into a valid route and reach a comparison that decoded the original malformed pathname outside the guarded decoding operation. The resulting unhandled URIError could crash an adapter-node server and deny service to other requests. This issue is fixed in 2.70.4 and 3.1.1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-128118

SvelteKit: Build-time server-only module import guard could fail, resulting in server secrets being statically replaced in client bundle

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build-time server-only module guard did not treat src/params.js as a client entry point even though parameter matchers can run in the browser. Server-only modules imported through src/params.js could consequently enter the client bundle, where statically replaced private environment values or other server secrets could be exposed. This issue is fixed in 3.1.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-128119

SvelteKit: Private `query.batch` functions could collide, producing unexpected parameter / function combinations

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-128120

SvelteKit: DoS while parsing form data from a remote functions `form`

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 until 3.1.1, applications using the experimental remote functions flag and a remote form function could perform quadratic synchronous work while parsing a specially crafted request with many form entries. The parsing work could block the event loop for an extended period and deny service. This issue is fixed in 3.1.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-128100

Vault vulnerable to ACL deny bypass via case-variant auth method user and group names

Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2026-71972

U-Boot < 2027.01-rc1 Out-of-Bounds Write in BMP RLE8 Decoder

U-Boot before 2027.01-rc1 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Denx U-boot

Products

U-boot U-boot

CVE-2026-62973

BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-49990

BACnet Stack: AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-126063

Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer

Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside attribute values. When an application sanitizes untrusted HTML with the default parsing options, allows noscript, and sends serialized output to a scripting-enabled browser, the browser can parse markup that Nokogiri did not produce, enabling mutation cross-site scripting. Using parse_noscript_content_as_text: true is the recommended workaround, not the vulnerable default. JRuby is not affected because it does not implement Nokogiri::HTML5. This issue is fixed in version 1.19.5.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Sparklemotion

Products

Nokogiri