PT-2026-89868

A flaw resulting in XML external entity XXE was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 including older unsupported versions of Akana and has been...

Linux Distros Unpatched Vulnerability : CVE-2026-88030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file...

Linux Distros Unpatched Vulnerability : CVE-2026-89157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PCRE2 before 10.48, on 32-bit platforms, has a pcre2patternconvert out-of-bounds write when an attacker can provide a large pattern. CVE-2026-89157 Note that...

CVE-2026-89054

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054

CVE-2026-89054 is a missing authorization vulnerability in OpenNMS Horizon . The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH , leaving the shipped @PATCH endpoints for event configuration and SNMP data collection accessible withou...

EUVD-2026-75707

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CLSA-2026-1789050616 TuxCare security update for nodemailer (7 CVEs)

TuxCare rebuilt nodemailer to address 7 CVEs. Fixed in 2.7.2-tuxcare.5...

ROOT-APP-NPM-CVE-2026-33671 CVE-2026-33671 in picomatch - Patched by Root

Root has patched CVE-2026-33671 in the picomatch package for Root:npm. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-3510 CVE-2022-3510 in com.google.protobuf:protobuf-java - Patched by Root

Root has patched CVE-2022-3510 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-3509 CVE-2022-3509 in com.google.protobuf:protobuf-java - Patched by Root

Root has patched CVE-2022-3509 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2021-22570 CVE-2021-22570 in com.google.protobuf:protobuf-java - Patched by Root

Root has patched CVE-2021-22570 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-60005 CVE-2026-60005 in nginx - Patched by Root

Root has patched CVE-2026-60005 in the nginx package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-6653 CVE-2026-6653 in libxml2 - Patched by Root

Root has patched CVE-2026-6653 in the libxml2 package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-34475 CVE-2026-34475 in varnish - Patched by Root

Root has patched CVE-2026-34475 in the varnish package for Root:Debian:11. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-34073 CVE-2026-34073 in cryptography - Patched by Root

Root has patched CVE-2026-34073 in the cryptography package for Root:PyPI. Multiple fixed versions available...

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summarypraisonai/browser/server.py validates incoming WebSocket connections using a Chromeextension Origin check. The regex chrome-extension://a-z0-932 is applied withre.match, which only anchors at the start of the string, not the end. Any Originheader with more than 32 alphanumeric characters...

praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

Summarypraisonaiagents.tools.webcrawltools.webcrawl validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses httpx.Clientfollowredirects=True and does not revalidate redirect targets.An attacker-controlled public URL can pass...