praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets

Summarypraisonaiagents.tools.webcrawltools.webcrawl validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses httpx.Clientfollowredirects=True and does not revalidate redirect targets.An attacker-controlled public URL can pass...

OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information such as iSCSI credentials. The PATCH outcome is a security issue; the POST outcome is not a security issue...

PYSEC-2026-3852 OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information such as iSCSI credentials. The PATCH outcome is a security issue; the POST outcome is not a security issue...

CVE-2026-61915

A flaw was found in cyrus-imapd. An authenticated calendar user could trigger a double-free vulnerability in the Cyrus CalDAV worker. By sending a specially crafted PATCH request that includes PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind, the memor...

ROOT-APP-MAVEN-CVE-2025-52520 CVE-2025-52520 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2025-52520 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-34483 CVE-2026-34483 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-34483 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-34981 CVE-2023-34981 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2023-34981 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9277 CVE-2026-9277 in shell-quote - Patched by Root

Root has patched CVE-2026-9277 in the shell-quote package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-9287 CVE-2025-9287 in cipher-base - Patched by Root

Root has patched CVE-2025-9287 in the cipher-base package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41305 CVE-2026-41305 in postcss - Patched by Root

Root has patched CVE-2026-41305 in the postcss package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-31129 CVE-2022-31129 in moment - Patched by Root

Root has patched CVE-2022-31129 in the moment package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-24785 CVE-2022-24785 in moment - Patched by Root

Root has patched CVE-2022-24785 in the moment package for Root:npm. Multiple fixed versions available...

CVE-2026-87933 DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtilsMergePatch of the file cJSONUtils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to...

PT-2026-89576

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054: Missing Authorization

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

PT-2026-89285

Today is Patch Tuesday and it's a significant one. 966 vulnerabilities patched in the official count, with another 204 fixed separately earlier in September across Azure, Entra ID, Edge, and Copilot Studio. By any count this is the biggest single security release Microsoft has ever shipped. Two o...

Fedora 46 : stb (2026-ee846faf9d)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ee846faf9d advisory. Automatic update for stb-0^20260802.2c980bb-2.fc46. Changelog Thu Sep 10 2026 Benjamin A. Beasley - 0^20260802.2c980bb-2 - Patch stbsprintf: securit...

ROOT-APP-NPM-CVE-2024-55565 CVE-2024-55565 in nanoid - Patched by Root

Root has patched CVE-2024-55565 in the nanoid package for Root:npm. Multiple fixed versions available...

Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligne...

CVE-2026-80917

In the Linux kernel, the following vulnerability has been resolved: PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems On 32-bit systems the config space is too large to ioremap in one go, so pciecamcreate maps each bus segment separately and relies on the -addbus callback...