CVE-2026-41679

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration...

CVE-2026-44648

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data user handle,...

Atlassian Jira Service Management Data Center and Server 5.15.2 < 10.3.20 / 10.4.x < 11.3.5 (JSDSERVER-16574)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16574 advisory. - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior...

Missing Cryptographic Step

Overview Affected versions of this package are vulnerable to Missing Cryptographic Step due to the lack of enforcement for receiving a cryptographically-signed final chunk before the termination of the outer HTTP body. An attacker can cause undetected truncation of chunked messages by forwarding...

PT-2026-49153

Publisher note Fixed in v1.7.17. Operators running v1.7.17 should upgrade. The decompression-error path in MultiDataInterceptor.ProcessReceivedMessage now releases the global throttler slot before returning guarded defer after StartProcessing, disabled when the asynchronous goroutine takes...

GHSA-49RJ-9FVP-4H2H React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in...

CVE-2026-25681 vulnerabilities

Vulnerabilities for packages: kots, ingress-nginx-controller, glab, hydra, gptscript, telegraf, kyverno, mattermost, helm, kubernetes, step, kubernetes-dashboard, terraform-provider-acme, zot, traefik, hubble, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization,...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: kots, ingress-nginx-controller, glab, hydra, gptscript, telegraf, kyverno, mattermost, helm, kubernetes, step, kubernetes-dashboard, terraform-provider-acme, zot, traefik, hubble, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization,...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: kots, ingress-nginx-controller, glab, hydra, gptscript, telegraf, kyverno, mattermost, helm, kubernetes, step, kubernetes-dashboard, terraform-provider-acme, zot, traefik, hubble, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization,...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: kots, ingress-nginx-controller, glab, hydra, gptscript, telegraf, kyverno, mattermost, helm, kubernetes, step, kubernetes-dashboard, terraform-provider-acme, zot, traefik, hubble, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization,...

GHSA-WRH2-89VG-4J9G vulnerabilities

Vulnerabilities for packages: kots, ingress-nginx-controller, glab, hydra, gptscript, telegraf, kyverno, mattermost, helm, kubernetes, step, kubernetes-dashboard, terraform-provider-acme, zot, traefik, hubble, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization,...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: kots, ingress-nginx-controller, glab, hydra, gptscript, telegraf, kyverno, mattermost, helm, kubernetes, step, kubernetes-dashboard, terraform-provider-acme, zot, traefik, hubble, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization,...

GHSA-W9P8-PVXH-RXPJ vulnerabilities

Vulnerabilities for packages: kots, ingress-nginx-controller, glab, hydra, gptscript, telegraf, kyverno, mattermost, helm, kubernetes, step, kubernetes-dashboard, terraform-provider-acme, zot, traefik, hubble, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization,...

GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: kots, ingress-nginx-controller, glab, hydra, gptscript, telegraf, kyverno, mattermost, helm, kubernetes, step, kubernetes-dashboard, terraform-provider-acme, zot, traefik, hubble, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization,...

CVE-2026-42502 vulnerabilities

Vulnerabilities for packages: kots, ingress-nginx-controller, glab, hydra, gptscript, telegraf, kyverno, mattermost, helm, kubernetes, step, kubernetes-dashboard, terraform-provider-acme, zot, traefik, hubble, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization,...

GHSA-5CV4-JP36-H3MW vulnerabilities

Vulnerabilities for packages: kots, ingress-nginx-controller, glab, hydra, gptscript, telegraf, kyverno, mattermost, helm, kubernetes, step, kubernetes-dashboard, terraform-provider-acme, zot, traefik, hubble, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization,...

PT-2026-45834

Name of the Vulnerable Software and Affected Versions React Router versions 7.0.0 through 7.14.1 Description When using Framework Mode, a combination of steps could allow unauthorized remote code execution RCE through external requests. This occurs because the vendored turbo-stream v2 can be abus...

How to Get a Reddit API Key in 2026: Step-by-Step Guide

Getting a Reddit API key starts with creating an application through Reddit’s developer portal and understanding how its…...

CVE-2026-44648

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data user handle,...

CVE-2026-45548 Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetchfileUrl directly without the IP blacklist validation that is consistently applied to all other automation steps. This allows an authenticated...