Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports

Two security flaws in Paperclip could let attackers execute commands on a network server or a developer's computer. Paperclip is an open-source control plane for teams of artificial intelligence AI agents, and both paths rely on importing a malicious agent and starting it. A third flaw could expo...

CLEANSTART-2026-AQ74255 Security fixes in cadvisor 0.57.0-r1

Package cadvisor version 0.57.0-r1 fixes 2 vulnerabilities: ghsa-xjvp-4fhw-gc47, CVE-2026-41579...

CLEANSTART-2026-ZH32905 Security fixes in kyverno-fips 1.17.1-r2

Package kyverno-fips version 1.17.1-r2 fixes 2 vulnerabilities: CVE-2025-15558, ghsa-p436-gjf2-799p...

GHSA-8WHX-365G-H9VV vulnerabilities

Vulnerabilities for packages: ruby4.0-rails, ruby3.2-rails, ruby3.3-rails, pghero, ruby3.4-rails, pghero-fips...

GHSA-GGVW-PP2V-J3GM vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp, linux-qemu-melange, linux-azure...

GHSA-X35M-3GP4-4FH5 vulnerabilities

Vulnerabilities for packages: dapr, juicefs...

GHSA-65RF-W3QG-H7VH vulnerabilities

Vulnerabilities for packages: firefox-esr...

GHSA-QW95-8564-VHVR vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-57XV-4VP5-7V49 vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-XJQX-FRCX-9W6G vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: nerdctl, osv-scanner, grafana-fips, witness, zarf-fips, cloud-provider-aws, buildah-fips, external-secrets-operator, snyk-cli, cloudbeat-fips, harbor-fips, nuclei, helm, go-discover, amazon-ssm-agent, kaf, chezmoi, kubernetes-fips, pulumi-kubernetes-operator,...

GHSA-52X6-GQ3R-VPF4 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-MPWR-8VM7-H73F vulnerabilities

Vulnerabilities for packages: telegraf, crossplane-provider-azure-authorization, external-secrets-operator, gobuster, x509-certificate-exporter, crossplane-provider-azure-managedidentity, nfpm, crossplane-provider-azure-sql, grafana, goreleaser, nuclei, crossplane-provider-azure-storage,...

GHSA-68VW-XV3C-52VP vulnerabilities

Vulnerabilities for packages: expat...

GHSA-H67P-54HQ-RP68 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, saf, kubeflow-katib, langfuse, renovate, py3-jupyterlab, code-server, pulumi, argo-workflows, ts-patch, prism, vitess, airflow, eslint, sqlpad, tileserver-gl, lerna, thingsboard, opensearch-dashboards...

GHSA-VGXX-5XJ5-Q97X vulnerabilities

Vulnerabilities for packages: openssl...

GHSA-58MV-QQMV-GQGV vulnerabilities

Vulnerabilities for packages: openssl, libcrypto3-2.34...

CLEANSTART-2026-JY46135 Security fixes for ghsa-m5vv-6r4h-3vj9 applied in versions: 0.12.0-r3

Security vulnerability affects the modelmesh-runtime-adapter package. This issue is resolved in later releases. See references for vulnerability details...

GHSA-5PVG-856G-CP85 vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, trino, zipkin, spark, thingsboard, elasticsearch-fips, seata, s3proxy, hono, apache-pulsar-fips, kafka-bridge, management-api-for-apache-cassandra-4.1, wildfly, apache-nifi, celeborn, keycloak-fips, sonarqube, akhq, strimzi-kafka-operator,...

GHSA-X4GW-5CX5-PGMH vulnerabilities

Vulnerabilities for packages: trino, apache-nifi-registry, ghidra, kafka, logstash-fips, kafka-bridge, apache-nifi, akhq, flyway-fips, zookeeper-fips, grpc-java-fips, request-9047-keycloak-fips, cassandra-reaper, selenium, airbyte-server, management-api-for-apache-cassandra-5.0, kafbat-ui-fips,...