CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054

CVE-2026-89054 is a missing authorization vulnerability in OpenNMS Horizon . The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH , leaving the shipped @PATCH endpoints for event configuration and SNMP data collection accessible withou...

EUVD-2026-75707

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

SUSE CVE-2026-61915

An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...

CLSA-2026-1789050616 TuxCare security update for nodemailer (7 CVEs)

TuxCare rebuilt nodemailer to address 7 CVEs. Fixed in 2.7.2-tuxcare.5...

ROOT-APP-NPM-CVE-2026-33671 CVE-2026-33671 in picomatch - Patched by Root

Root has patched CVE-2026-33671 in the picomatch package for Root:npm. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-3510 CVE-2022-3510 in com.google.protobuf:protobuf-java - Patched by Root

Root has patched CVE-2022-3510 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2021-22570 CVE-2021-22570 in com.google.protobuf:protobuf-java - Patched by Root

Root has patched CVE-2021-22570 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-3509 CVE-2022-3509 in com.google.protobuf:protobuf-java - Patched by Root

Root has patched CVE-2022-3509 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-60005 CVE-2026-60005 in nginx - Patched by Root

Root has patched CVE-2026-60005 in the nginx package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-6653 CVE-2026-6653 in libxml2 - Patched by Root

Root has patched CVE-2026-6653 in the libxml2 package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-34475 CVE-2026-34475 in varnish - Patched by Root

Root has patched CVE-2026-34475 in the varnish package for Root:Debian:11. Multiple fixed versions available...

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summarypraisonai/browser/server.py validates incoming WebSocket connections using a Chromeextension Origin check. The regex chrome-extension://a-z0-932 is applied withre.match, which only anchors at the start of the string, not the end. Any Originheader with more than 32 alphanumeric characters...

praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

Summarypraisonaiagents.tools.webcrawltools.webcrawl validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses httpx.Clientfollowredirects=True and does not revalidate redirect targets.An attacker-controlled public URL can pass...

PYSEC-2026-3900 praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

Summary praisonaiagents.tools.webcrawltools.webcrawl validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses httpx.Clientfollowredirects=True and does not revalidate redirect targets. An attacker-controlled public URL can pas...

PYSEC-2026-3852 OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information such as iSCSI credentials. The PATCH outcome is a security issue; the POST outcome is not a security issue...

OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information such as iSCSI credentials. The PATCH outcome is a security issue; the POST outcome is not a security issue...

CVE-2026-61915

A flaw was found in cyrus-imapd. An authenticated calendar user could trigger a double-free vulnerability in the Cyrus CalDAV worker. By sending a specially crafted PATCH request that includes PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind, the memor...

ROOT-APP-MAVEN-CVE-2023-34981 CVE-2023-34981 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2023-34981 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...