EUVD-2026-46359

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Summary The Gitea Docker images ship an app.ini template that hard-codes: REVERSEPROXYTRUSTEDPROXIES = The documented default for this setting, in custom/conf/app.example.ini, is 127.0.0.0/8,::1/128, i.e. only loopback is trusted. When an admin enables ENABLEREVERSEPROXYAUTHENTICATION = true to p...

CVE-2026-16441

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...

CVE-2026-16441

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...

CVE-2026-16441

Eclipse OpenJ9 up to version 0.60 has a method resolution flaw (CWE-758): when a previously concrete superclass method is recompiled as abstract, the JVM incorrectly delegates execution to an interface default method, potentially running unintended code. SUSE addressed this in Java 8.0 SR8 FP70; ...

CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...

CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...

CVE-2026-16441 Eclipse OpenJ9 : Method resolution default method precedence failure

In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method...

CVE-2026-47407

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under /api/v1/workspaces/workspaceid/... and protects them with a requireworkspacememberworkspaceid FastAPI dependency. The dependency only checks tha...

CVE-2026-47410 praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal "dev-secret-change-me" when PLATFORMJWTSECRET is unset. A safety check exists but only...

CVE-2026-47410 praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal "dev-secret-change-me" when PLATFORMJWTSECRET is unset. A safety check exists but only...

CVE-2026-47407 PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under /api/v1/workspaces/workspaceid/... and protects them with a requireworkspacememberworkspaceid FastAPI dependency. The dependency only checks tha...

CVE-2026-47407 PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under /api/v1/workspaces/workspaceid/... and protects them with a requireworkspacememberworkspaceid FastAPI dependency. The dependency only checks tha...

CVE-2026-47407

PraisonAI Platform prior to v0.1.4 has cross-tenant IDOR and privilege-escalation flaws: the URL workspace_id is not validated against inner resources, enabling read/update/delete of other tenants’ data; and member-role checks allow basic members to promote themselves or modify/remove others and ...

CVE-2026-47393

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...

CVE-2026-47393 PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default

PraisonAI is a multi-agent teams system. CVE-2026-44338 GHSA-6rmh-7xcm-cpxj documents that PraisonAI ships a code-generator praisonai.deploy.api.generateapiservercode that emits a Flask API server with authentication disabled by default. Users who follow the documented quickstart praisonai deploy...

CVE-2026-62415 Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2

The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets...

PT-2026-62027

Name of the Vulnerable Software and Affected Versions Eclipse OpenJ9 versions prior to 0.61 Description An issue occurs when executing class files where a superclass method, which was previously concrete, has been recompiled as abstract. In this scenario, the execution is incorrectly delegated to...

PT-2026-63585

Name of the Vulnerable Software and Affected Versions fastjson versions 1.2.68 through 1.2.83 Description A remote code execution RCE issue exists in the fastjson library, specifically impacting Spring Boot applications. This flaw allows an unauthenticated attacker to execute arbitrary code with...

GHSA-94PJ-82F3-465W Guzzle: Proxy-Authorization headers can be sent to origin servers

Impact In affected versions, the built-in cURL handlers CurlHandler and CurlMultiHandler put every first-class request header in cURL's origin header list CURLOPTHTTPHEADER. These handlers are the default when the PHP cURL extension is available. They move Proxy-Authorization to the proxy-only li...