PYSEC-2026-3502 PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard Summary PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in...

PYSEC-2026-3503 PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools

HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summary praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into...

openjdk: OpenJDK: Enhance XBM image support (Oracle CPU 2026-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.1...

openjdk: OpenJDK: Enhance AWT ImagingLib (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...

CVE-2026-65550

Technical details for CVE-2026-65550 are not publicly provided in the supplied documents; monitor for updates on affected versions, impact, and remediation.

RHSA-2026:43401 Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update

Bulletin has no description...

EUVD-2026-47914

Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs...

CVE-2026-64799

Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...

EUVD-2026-47915

Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...

openjdk: OpenJDK: Enhance Jar handling (Oracle CPU 2026-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...

CVE-2026-59890 vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.1, openstack-placement-2025.2-fips, spamcheck, nvidia-nsight-compute-13.3, kubeflow-jupyter-web-app, openstack-horizon-2025.2, openstack-keystone-2025.1-fips, openstack-glance-2025.1-fips, openstack-glance-2026.1, kubeflow-volumes-web-app,...

GHSA-H35F-9H28-MQ5C vulnerabilities

Vulnerabilities for packages: openstack-glance-2025.1, openstack-placement-2025.2-fips, spamcheck, nvidia-nsight-compute-13.3, kubeflow-jupyter-web-app, openstack-horizon-2025.2, openstack-keystone-2025.1-fips, openstack-glance-2025.1-fips, openstack-glance-2026.1, kubeflow-volumes-web-app,...

GHSA-8PPF-4F7H-5PPJ vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, datadog-agent, kubeflow-volumes-web-app, spamcheck, superset, openstack-keystone-2025.1-fips, datadog-agent-fips, k8s-sidecar, kubeflow-jupyter-web-app, openstack-keystone-2025.2-fips, azureml-inference-server-http-fips, awx...

CVE-2026-59886 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, datadog-agent, kubeflow-volumes-web-app, spamcheck, superset, openstack-keystone-2025.1-fips, datadog-agent-fips, k8s-sidecar, kubeflow-jupyter-web-app, openstack-keystone-2025.2-fips, azureml-inference-server-http-fips, awx...

CVE-2026-59885 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-fips, datadog-agent, kubeflow-volumes-web-app, spamcheck, superset, openstack-keystone-2025.1-fips, datadog-agent-fips, k8s-sidecar, kubeflow-jupyter-web-app, openstack-keystone-2025.2-fips, azureml-inference-server-http-fips, awx...

openjdk: OpenJDK: Enhance Dataview Implementation (Oracle CPU 2026-07)

Vulnerability in Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful...

openjdk: OpenJDK: Enhance Jar file processing (Oracle CPU 2026-07)

Vulnerability in Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability...

openjdk: OpenJDK: Enhance XBM image support (Oracle CPU 2026-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.1...

CVE-2026-7534

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...

EUVD-2026-47884

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data...