171236 matches found
patchExploitPocGenerator
patchExploitP...
CVE-2026-89054
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
EUVD-2026-75707
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes
A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...
CVE-2026-89054
CVE-2026-89054 is a missing authorization vulnerability in OpenNMS Horizon . The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH , leaving the shipped @PATCH endpoints for event configuration and SNMP data collection accessible withou...
SUSE CVE-2026-61915
An issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding th...
CLSA-2026-1789050616 TuxCare security update for nodemailer (7 CVEs)
TuxCare rebuilt nodemailer to address 7 CVEs. Fixed in 2.7.2-tuxcare.5...
ROOT-APP-NPM-CVE-2026-33671 CVE-2026-33671 in picomatch - Patched by Root
Root has patched CVE-2026-33671 in the picomatch package for Root:npm. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2022-3510 CVE-2022-3510 in com.google.protobuf:protobuf-java - Patched by Root
Root has patched CVE-2022-3510 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2021-22570 CVE-2021-22570 in com.google.protobuf:protobuf-java - Patched by Root
Root has patched CVE-2021-22570 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2022-3509 CVE-2022-3509 in com.google.protobuf:protobuf-java - Patched by Root
Root has patched CVE-2022-3509 in the com.google.protobuf:protobuf-java package for Root:Maven. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-60005 CVE-2026-60005 in nginx - Patched by Root
Root has patched CVE-2026-60005 in the nginx package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-6653 CVE-2026-6653 in libxml2 - Patched by Root
Root has patched CVE-2026-6653 in the libxml2 package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-34475 CVE-2026-34475 in varnish - Patched by Root
Root has patched CVE-2026-34475 in the varnish package for Root:Debian:11. Multiple fixed versions available...
PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)
Summarypraisonai/browser/server.py validates incoming WebSocket connections using a Chromeextension Origin check. The regex chrome-extension://a-z0-932 is applied withre.match, which only anchors at the start of the string, not the end. Any Originheader with more than 32 alphanumeric characters...
PYSEC-2026-3900 praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets
Summary praisonaiagents.tools.webcrawltools.webcrawl validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses httpx.Clientfollowredirects=True and does not revalidate redirect targets. An attacker-controlled public URL can pas...
praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets
Summarypraisonaiagents.tools.webcrawltools.webcrawl validates the initial URL and blocks direct loopback/private destinations by default, but the default httpx fallback still uses httpx.Clientfollowredirects=True and does not revalidate redirect targets.An attacker-controlled public URL can pass...
OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties
In OpenStack Ironic through 35.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information such as iSCSI credentials. The PATCH outcome is a security issue; the POST outcome is not a security issue...