CVE-2026-42261

PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to before version 0.5.4, apps/web/src/routes/skills.ts exposes an authenticated endpoint POST /api/skills/fetch-remote that fetches a user-supplied URL server-side and reflects the response body up t...

CVE-2026-32294 JetKVM insufficient firmware verification

JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding SHA256 hash to pass verification...

Trillium Injection Vulnerability

Trillium is a composable toolkit from the Trillium community for building Internet applications using asynchronous Rust. An injection vulnerability exists in Trillium versions prior to 0.3.12 and 0.5.x prior to 0.5.4, which stems from insufficient header validation and may result in a split reque...