CVE-2026-128088

russh try_sign: asynchronous confirmation can sign after agent lock

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, try_sign() captures an Arc<PrivateKey> before awaiting Agent::confirm() and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in the remediation for CVE-2026-116794. A peer, including a remote SSH server using agent forwarding, can begin a confirmation-constrained signature request while the agent is unlocked and receive the signature after another connection locks the agent if the stale confirmation returns true. New post-lock requests are rejected and private key material is not disclosed, but the pending operation bypasses the current lock state. This issue is fixed in version 0.65.1.

CVSS 3.1 · 2.2 Low EPSS n/a KEV · Not listed

Vendors

Eugeny

Products

Russh

CVE-2026-128089

dnspython excessive memory and CPU use

dnspython is a DNS toolkit for Python. Prior to version 2.9.2, the from_text() parser for WKS records does not require the service number to be between 0 and 65535 before using it as a bitmap offset. An attacker-controlled zone file can supply a larger number, causing the service bitmap to grow to an extremely large size through inefficient repeated extension, consuming excessive memory and CPU and potentially terminating the process. Applications are affected only when they parse zone-file text whose record type and rdata are attacker controlled. This issue is fixed in version 2.9.2.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Rthalley

Products

Dnspython

CVE-2026-128116

SvelteKit: Protocol-relative module import during server-side route resolution allows cross-origin script execution

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, apps configured with router.resolution: 'server' could treat a pathname beginning with // as a protocol-relative module specifier during client-side navigation. A socially engineered link could therefore make server-side route resolution import and execute JavaScript from another origin in the user's browser. This issue is fixed in 2.70.4 and 3.1.1.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-128117

SvelteKit: Unhandled URIError when `reroute` rewrites a malformed pathname crashes adapter-node

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, the reroute hook could rewrite an invalid percent-encoded pathname into a valid route and reach a comparison that decoded the original malformed pathname outside the guarded decoding operation. The resulting unhandled URIError could crash an adapter-node server and deny service to other requests. This issue is fixed in 2.70.4 and 3.1.1.

CVSS 3.1 · 5.9 Medium EPSS n/a KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-128118

SvelteKit: Build-time server-only module import guard could fail, resulting in server secrets being statically replaced in client bundle

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build-time server-only module guard did not treat src/params.js as a client entry point even though parameter matchers can run in the browser. Server-only modules imported through src/params.js could consequently enter the client bundle, where statically replaced private environment values or other server secrets could be exposed. This issue is fixed in 3.1.1.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-128119

SvelteKit: Private `query.batch` functions could collide, producing unexpected parameter / function combinations

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 until 3.1.1, applications using the experimental remote functions flag could assign the same generated identifier to separate non-exported query.batch functions. When those private functions shared a request batch, arguments intended for one function could be passed to another function, causing unexpected cross-function processing and possible disclosure of function arguments. This issue is fixed in 3.1.1.

CVSS 3.1 · 5.9 Medium EPSS n/a KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-128120

SvelteKit: DoS while parsing form data from a remote functions `form`

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 until 3.1.1, applications using the experimental remote functions flag and a remote form function could perform quadratic synchronous work while parsing a specially crafted request with many form entries. The parsing work could block the event loop for an extended period and deny service. This issue is fixed in 3.1.1.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Svelte

Products

Kit

CVE-2026-128100

Vault vulnerable to ACL deny bypass via case-variant auth method user and group names

Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissions to modify a protected user or group, potentially leading to privilege escalation. This vulnerability (CVE-2026-128100) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2026-71972

U-Boot < 2027.01-rc1 Out-of-Bounds Write in BMP RLE8 Decoder

U-Boot before 2027.01-rc1 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Denx U-boot

Products

U-boot U-boot

CVE-2026-62973

BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-49990

BACnet Stack: AtomicReadFile/AtomicWriteFile stream fileStartPosition validation flaw causes out-of-bounds read/write in RAM file backends

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.

CVSS 3.1 · 8.6 High EPSS n/a KEV · Not listed

Vendors

Bacnetstack

Products

Bacnet Stack

CVE-2026-55335

Use-After-Free in Android Code Allows Remote Code Execution

In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-55344

Local Privilege Escalation via Heap Buffer Overflow in Android TzSharedMemory

In TzSharedMemory of TzSharedMemory.c, there is a possible Heap buffer overflow due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-55346

Local Privilege Escalation via Heap Out-of-Bounds Write in Android Keymaster

In km_read_data_response of keymaster.c, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-56943

Android Attestation Out-of-Bounds Read Leading to Local Information Disclosure

In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-56946

Local Privilege Escalation in ARM SMMU v3 Driver

In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-56956

Heap Buffer Overflow in Android TextRtpPayloadEncoderNode Enables Remote Code Execution

In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-56969

Use‑After‑Free in Android edgetpu_group Culminating in Local Privilege Escalation

In edgetpu_group_clear_responses of edgetpu_group.c, there is a possible Use After Free due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-56995

Shared Memory Allocator Metadata Corruption Enables Local Privilege Escalation on Android

In multiple locations, there is a possible way to corrupt host allocator metadata in shared memory due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-57009

Logic Error in Android AVC Decoder Allows Local Privilege Escalation

In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—