Security advisories

critical2026-04-16

CVE-2026-41478-Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)

saltcorn/saltcorn · GHSA-jp74-mfrx-3qvh

high2026-04-16

Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)

umutkorkmaz/meridian · GHSA-f5v8-v6q3-q4h6

critical2026-04-16

Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise

paperclipai/paperclip · GHSA-3xx2-mqjm-hg9x

medium2026-04-16

Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization

paperclipai/paperclip · GHSA-fpw4-p57j-hqmq

medium2026-04-16

Paperclip: Approval decision attribution spoofing via client-controlled `decidedByUserId` in paperclip server

paperclipai/paperclip · GHSA-p7mm-r948-4q3q

critical2026-04-16

Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys

paperclipai/paperclip · GHSA-47wq-cj9q-wpmp

critical2026-04-16

Paperclip: OS Command Injection via Execution Workspace cleanupCommand

paperclipai/paperclip · GHSA-vr7g-88fq-vhq3

high2026-04-16

Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email

paperclipai/paperclip · GHSA-gqqj-85qm-8qhf

high2026-04-16

Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode

paperclipai/paperclip · GHSA-xfqj-r5qw-8g4j

high2026-04-16

Paperclip: Malicious skills able to exfiltrate and destroy all user data

paperclipai/paperclip · GHSA-w8hx-hqjv-vjcq

high2026-04-16

CVE-2026-41208-Paperclip: Privilege Escalation via Agent-Controlled workspaceStrategy.provisionCommand Leading to OS Command Execution

paperclipai/paperclip · GHSA-265w-rf2w-cjh4

medium2026-04-16

Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath

paperclipai/paperclip · GHSA-3pw3-v88x-xj24

high2026-04-16

CVE-2026-41427-OAuth 2.1 Provider: Unprivileged users can register OAuth clients

better-auth/better-auth · GHSA-xr8f-h2gw-9xh6

critical2026-04-16

CVE-2026-41428-Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints

budibase/budibase · GHSA-8783-3wgf-jggf

high2026-04-16

CVE-2026-40897-Unsafe object property setter in mathjs

josdejong/mathjs · GHSA-29qv-4j9f-fjw5

medium2026-04-16

CVE-2026-41425-Authlib: Cross-site request forging when using cache

authlib/authlib · GHSA-jj8c-mmj3-mmgv

high2026-04-16

CVE-2026-41423-Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

angular/angular · GHSA-45q2-gjvg-7973

critical2026-04-16

CVE-2026-41242-protobufjs has an arbitrary code execution issue

protobufjs/protobuf.js · GHSA-xq3m-2v4x-88gg

medium2026-04-16

CVE-2026-6410-@fastify/static vulnerable to path traversal in directory listing

fastify/fastify-static · GHSA-pr96-94w5-mx2h

medium2026-04-16

CVE-2026-6414-@fastify/static vulnerable to route guard bypass via encoded path separators

fastify/fastify-static · GHSA-x428-ghpx-8j92