PatchTheCVE: steipetehttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2026-45246: Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configurationhttps://patchthecve.com/cve/CVE-2026-45246.htmlhttps://patchthecve.com/cve/CVE-2026-45246.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 5.5: Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the rCVE-2026-45245: Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages tohttps://patchthecve.com/cve/CVE-2026-45245.htmlhttps://patchthecve.com/cve/CVE-2026-45245.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 7.4: Summarize prior to 0.15.1 contains a vulnerability in the hover summary feature that allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links, causing the extension to make authenticated daemon requests using stored tokens without verifying event trustworthiness. CVE-2026-45244: Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browhttps://patchthecve.com/cve/CVE-2026-45244.htmlhttps://patchthecve.com/cve/CVE-2026-45244.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 5.4: Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke CVE-2026-45243: Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMesshttps://patchthecve.com/cve/CVE-2026-45243.htmlhttps://patchthecve.com/cve/CVE-2026-45243.htmlWed, 14 Oct 2026 20:10:00 +0000MEDIUM 6.1: Summarize prior to 0.15.1 contains a missing authorization vulnerability in the content script window.postMessage bridge that allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, creaCVE-2026-45242: Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that alhttps://patchthecve.com/cve/CVE-2026-45242.htmlhttps://patchthecve.com/cve/CVE-2026-45242.htmlWed, 14 Oct 2026 20:10:00 +0000HIGH 7.1: Summarize prior to 0.15.1 contains a path traversal vulnerability in the /v1/summarize daemon endpoint that allows authenticated callers to write files to arbitrary directories by supplying an absolute path or directory traversal sequence in the slidesDir request parameter. Attackers can exploit thi