CVE-2026-59582

Integer Overflow in UcePublishManager Leading to Remote Denial of Service

In StartTimer of UcePublishManager.cpp, there is a possible way to trigger a process abort during timer calculation due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-59593

AV1 Decoder Heap Buffer Overflow Enables Local Privilege Escalation

In tile_info of av1_decoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-59603

Double Free in Android Message Transport Service Leading to Remote Denial of Service

In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger a double free and process abort during message retry handling due to a use after free. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-59604

Unbounded Loop in Android Video Decoder Causing Local Denial of Service

In multiple locations, there is a possible way to trigger an unbounded loop in video decoder firmware due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-59606

SSWRP CP Module Permission Bypass Enables Local Privilege Escalation

In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify global reset registers from non-secure software due to a permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-59625

Out‑of‑Bounds Write in Android Texture Management Enables Remote Code Execution

In GetTwiddledMiptreeSparsePageMap of texmgmt.c, there is a possible way to trigger an out of bounds write due to a logic error. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android

CVE-2026-63167

Omnispace Agora Project 26.10.0 SQL Injection via personsSort Session Value

Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general administrators to inject arbitrary SQL by setting the personsSort session value, which is concatenated unsanitized into ORDER BY clauses in MdlUser.php and MdlSpace.php. Attackers can submit an error-based extractvalue payload through personsSort to leak database information, such as the MariaDB version, via the user and space listing pages.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-129166

Keep 0.34.10 through 0.55.0 Blind SQL Injection via CEL Bracket-Indexed JSON Keys

Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bracket-indexed JSON keys from CEL filters unescaped into JSON path expressions for SQLite, PostgreSQL, and MySQL. Authenticated users with read:alert permission can submit crafted CEL expressions to /alerts/query or the cel parameter of /incidents, using result counts as a boolean oracle to extract other tenants' alerts and password hashes.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Keephq

Products

Keep

CVE-2026-129139

paicoding commit b8206b9 through 903adce Predictable ZSXQ Account Credentials

paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, because loginByZsxq derives both the username and password solely from the member's ZSXQ number. Unauthenticated attackers can read that number from the victim's /user/{userId} profile page, compute the credentials, and log in via /login/username to take over the account.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Itwanger

Products

Paicoding

CVE-2026-128084

sqlite3-ruby: SQL Query Truncation

sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Database#prepare, bound String or Blob values through Statement#bind_param, and String or Blob results from Ruby-defined SQL functions and aggregates through Database#create_function and Database#create_aggregate. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger can wrap the length so SQLite processes only a prefix. A truncated SQL string can drop trailing clauses such as a WHERE condition, while a truncated bound value matters only when the application validated the full value before binding it. Exploitation requires the application and server to accept and retain the unusually large attacker-controlled string. If a dropped SQL clause contained a bind placeholder, binding raises SQLite3::RangeException instead of running the query. This issue is fixed in version 2.10.2.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Sparklemotion

Products

Sqlite3-ruby

CVE-2026-127214

Flowise 3.1.4 SSRF Bypass via Custom Function Sandbox

Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with chatflows or agentflows create/update permissions to bypass the Custom Function sandbox's SSRF protection by requiring a module subpath inside an allowlisted package, such as axios/dist/node/axios.cjs or node-fetch/lib/index.js, which evades the vm2 mock table and returns an unwrapped HTTP client that skips the checkDenyList validation. Attackers can issue arbitrary GET and POST requests with attacker-controlled bodies via POST /api/v1/node-custom-function to reach loopback and internal-network addresses or the cloud metadata endpoint, enabling network mapping, credential disclosure, and state changes on internal services.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Flowiseai

Products

Flowise

CVE-2026-128122

SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 4.7.0 until versions 7.2.10 and 8.0.2, @sveltejs/adapter-cloudflare allowed an attacker-influenced link crawled during prerendering to place whitespace, control characters, wildcards, or placeholders into a prerendered redirect path. The adapter wrote those paths into the Cloudflare _redirects output without output-context validation, allowing a path to create unintended routing rules that could redirect or expose requests beyond the intended prerendered route. This issue is fixed in 7.2.10 and 8.0.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-128124

AIOHTTP: Event loop stall in add_domain() wildcard matching

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.add_domain() converts every asterisk wildcard in a domain mask into a greedy regular-expression fragment, so a mask containing two or more wildcards can take polynomial time to reject a long Host header that does not match. A remote attacker can repeatedly send such headers to a server configured with a multi-wildcard domain mask and stall the event loop. This issue is fixed in version 3.14.4.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Aio-libs

Products

Aiohttp

CVE-2026-92738

Expired Vault login MFA requests may remain redeemable

Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2026-128125

AIOHTTP: Unbounded cookie storage in client CookieJar

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicious server can make an aiohttp client accumulate a very large cookie set, consume memory and CPU repeatedly across redirects, and construct an excessively large Cookie header for later requests to the same domain. This issue is fixed in version 3.14.4.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Aio-libs

Products

Aiohttp

CVE-2026-89037

Dolibarr < 24.0.2 IDOR via Ticket Documents API

Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the ticket module that allows authenticated API users to access ticket attachments belonging to other companies by omitting a company-scope check that is only applied via a session variable set during public ticket authentication, which REST API authentication never sets. Attackers with ticket read permission can enumerate predictable ticket identifiers and supply them to the documents endpoint or download path to retrieve sensitive attachments such as invoices and contracts belonging to other third parties.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Dolibarr

Products

Dolibarr

CVE-2026-128126

AIOHTTP: Too many URL-encoded form fields block the event loop

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Request.post() does not limit the number of fields in a URL-encoded form body, and inserting many repeated keys into MultiDict takes quadratic time on the event loop. A remote attacker can send a form POST within client_max_size to a handler that calls Request.post() and block the event loop. This issue is fixed in version 3.14.4.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Aio-libs

Products

Aiohttp

CVE-2026-128127

AIOHTTP: Base64 multipart parts bypass client_max_size

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.read_chunk() processing a multipart part with Content-Transfer-Encoding set to base64 keeps reading until the chunk length is a multiple of four without enforcing a byte limit. A short Content-Length or a long run of whitespace can cause one call to read the remaining body into memory before the size check or spin on the event loop. A remote attacker can send such a multipart request to a handler that reads multipart data and bypass client_max_size. This issue is fixed in version 3.14.4.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Aio-libs

Products

Aiohttp

CVE-2026-128129

AIOHTTP: Unbounded buffering of data received during an upgrade request

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit or flow control. A remote attacker can stream data behind an upgrade request to a handler that does not immediately accept or reject the upgrade and cause unbounded memory consumption. This issue is fixed in version 3.14.4.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Aio-libs

Products

Aiohttp

CVE-2026-128130

AIOHTTP: Pure-Python parser request replay and buffer growth behind a declined upgrade

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, when the pipelined request queue is full, the pure-Python parser stores the unparsed remainder internally and also returns the same data to its caller. After a handler declines an upgrade request, the caller feeds the remainder back to the parser, causing the buffer to grow with each handled request and dispatching already-handled requests to the application again. The issue affects deployments using AIOHTTP_NO_EXTENSIONS or otherwise running without the standard C-extension wheel, and can cause excessive memory use and repeated request processing. This issue is fixed in version 3.14.4.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Aio-libs

Products

Aiohttp