assimp:assimp_fuzzer_ifc: Bad-cast to std::__shared_weak_count from invalid vptr in std::__1::shared_ptr<Assimp::STEP::EXPRESS::DataType const>::shared_ptr

Detailed Report: https://oss-fuzz.com/testcase?key=4579058511052800 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzerifc Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5615beca3bf0 Crash State: Bad-cast to std::sharedweakcount from invali...

Atlassian Jira Service Management Data Center and Server 5.15.2 < 10.3.20 / 10.4.x < 11.3.5 (JSDSERVER-16574)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16574 advisory. - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior...

Missing Cryptographic Step

Overview Affected versions of this package are vulnerable to Missing Cryptographic Step due to the lack of enforcement for receiving a cryptographically-signed final chunk before the termination of the outer HTTP body. An attacker can cause undetected truncation of chunked messages by forwarding...

CVE-2026-48480: Missing Cryptographic Step

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. An on-path adversar...

PT-2026-49153

Publisher note Fixed in v1.7.17. Operators running v1.7.17 should upgrade. The decompression-error path in MultiDataInterceptor.ProcessReceivedMessage now releases the global throttler slot before returning guarded defer after StartProcessing, disabled when the asynchronous goroutine takes...

GHSA-49RJ-9FVP-4H2H React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in...

CVE-2026-42502 vulnerabilities

Vulnerabilities for packages: minio, kots, snyk-cli, ingress-nginx-controller, crossplane-provider-azure-storage, terraform-provider-acme, falco-no-driver, zot, crossplane-provider-aws-elasticache, glab, kine, external-secrets-operator, helm, kubernetes-dashboard, nerdctl,...

GHSA-WRH2-89VG-4J9G vulnerabilities

Vulnerabilities for packages: minio, kots, snyk-cli, ingress-nginx-controller, crossplane-provider-azure-storage, terraform-provider-acme, falco-no-driver, zot, crossplane-provider-aws-elasticache, glab, kine, external-secrets-operator, helm, kubernetes-dashboard, nerdctl,...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: minio, kots, snyk-cli, ingress-nginx-controller, crossplane-provider-azure-storage, terraform-provider-acme, falco-no-driver, zot, crossplane-provider-aws-elasticache, glab, kine, external-secrets-operator, helm, kubernetes-dashboard, nerdctl,...

CVE-2026-25681 vulnerabilities

Vulnerabilities for packages: minio, kots, snyk-cli, ingress-nginx-controller, crossplane-provider-azure-storage, terraform-provider-acme, falco-no-driver, zot, crossplane-provider-aws-elasticache, glab, kine, external-secrets-operator, helm, kubernetes-dashboard, nerdctl,...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: minio, kots, snyk-cli, ingress-nginx-controller, crossplane-provider-azure-storage, terraform-provider-acme, falco-no-driver, zot, crossplane-provider-aws-elasticache, glab, kine, external-secrets-operator, helm, kubernetes-dashboard, nerdctl,...

GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: minio, kots, snyk-cli, ingress-nginx-controller, crossplane-provider-azure-storage, terraform-provider-acme, falco-no-driver, zot, crossplane-provider-aws-elasticache, glab, kine, external-secrets-operator, helm, kubernetes-dashboard, nerdctl,...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: minio, kots, snyk-cli, ingress-nginx-controller, crossplane-provider-azure-storage, terraform-provider-acme, falco-no-driver, zot, crossplane-provider-aws-elasticache, glab, kine, external-secrets-operator, helm, kubernetes-dashboard, nerdctl,...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: minio, kots, snyk-cli, ingress-nginx-controller, crossplane-provider-azure-storage, terraform-provider-acme, falco-no-driver, zot, crossplane-provider-aws-elasticache, glab, kine, external-secrets-operator, helm, kubernetes-dashboard, nerdctl,...

GHSA-W9P8-PVXH-RXPJ vulnerabilities

Vulnerabilities for packages: minio, kots, snyk-cli, ingress-nginx-controller, crossplane-provider-azure-storage, terraform-provider-acme, falco-no-driver, zot, crossplane-provider-aws-elasticache, glab, kine, external-secrets-operator, helm, kubernetes-dashboard, nerdctl,...

GHSA-5CV4-JP36-H3MW vulnerabilities

Vulnerabilities for packages: minio, kots, snyk-cli, ingress-nginx-controller, crossplane-provider-azure-storage, terraform-provider-acme, falco-no-driver, zot, crossplane-provider-aws-elasticache, glab, kine, external-secrets-operator, helm, kubernetes-dashboard, nerdctl,...

PT-2026-45834

Name of the Vulnerable Software and Affected Versions React Router versions 7.0.0 through 7.14.1 Description When using Framework Mode, a combination of steps could allow unauthorized remote code execution RCE through external requests. This occurs because the vendored turbo-stream v2 can be abus...

How to Get a Reddit API Key in 2026: Step-by-Step Guide

Getting a Reddit API key starts with creating an application through Reddit’s developer portal and understanding how its…...

CVE-2026-44648

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, SillyTavern relies on cookie-session for authentication, storing all session data user handle,...

CVE-2026-45548 Budibase: SSRF in AI Extract File Automation Step via Missing IP Blacklist Validation

Budibase is an open-source low-code platform. Prior to 3.34.8, the processUrlFile function in packages/server/src/automations/steps/ai/extract.ts uses fetchfileUrl directly without the IP blacklist validation that is consistently applied to all other automation steps. This allows an authenticated...