PYSEC-2026-3503 PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools

HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summary praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into...

PYSEC-2026-3502 PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard Summary PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in...

openjdk: OpenJDK: Enhance AWT ImagingLib (Oracle CPU 2026-07)

A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries correctly. This can lead to the application attempting to access invalid memory or dereference a null pointer, which may cause the application to unexpectedly terminate...

openjdk: OpenJDK: Enhance XBM image support (Oracle CPU 2026-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.1...

CVE-2026-65550

Technical details for CVE-2026-65550 are not publicly provided in the supplied documents; monitor for updates on affected versions, impact, and remediation.

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...

RHSA-2026:43401 Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update

Bulletin has no description...

EUVD-2026-47914

Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs...

CVE-2026-64799

Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...

EUVD-2026-47915

Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...

openjdk: OpenJDK: Enhance Jar handling (Oracle CPU 2026-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...

GHSA-H35F-9H28-MQ5C vulnerabilities

Vulnerabilities for packages: openstack-placement-2025.2-fips, openstack-placement-2026.1-fips, datadog-agent-fips, openstack-glance-2025.1-fips, openstack-horizon-2025.2-fips, openstack-horizon-2025.1-fips, openstack-placement-2026.1, openstack-keystone-2025.2-fips, nvidia-nsight-compute-13.3,...

GHSA-8PPF-4F7H-5PPJ vulnerabilities

Vulnerabilities for packages: superset-fips, azureml-inference-server-http-fips, kubeflow-jupyter-web-app, authentik, kubeflow-pipelines-fips, spamcheck, datadog-agent, kubeflow-volumes-web-app, openstack-keystone-2025.2-fips, datadog-agent-fips, k8s-sidecar, awx, superset,...

CVE-2026-59890 vulnerabilities

Vulnerabilities for packages: openstack-placement-2025.2-fips, openstack-placement-2026.1-fips, datadog-agent-fips, openstack-glance-2025.1-fips, openstack-horizon-2025.2-fips, openstack-horizon-2025.1-fips, openstack-placement-2026.1, openstack-keystone-2025.2-fips, nvidia-nsight-compute-13.3,...

CVE-2026-59886 vulnerabilities

Vulnerabilities for packages: superset-fips, azureml-inference-server-http-fips, kubeflow-jupyter-web-app, authentik, kubeflow-pipelines-fips, spamcheck, datadog-agent, kubeflow-volumes-web-app, openstack-keystone-2025.2-fips, datadog-agent-fips, k8s-sidecar, awx, superset,...

CVE-2026-59885 vulnerabilities

Vulnerabilities for packages: superset-fips, azureml-inference-server-http-fips, kubeflow-jupyter-web-app, authentik, kubeflow-pipelines-fips, spamcheck, datadog-agent, kubeflow-volumes-web-app, openstack-keystone-2025.2-fips, datadog-agent-fips, k8s-sidecar, awx, superset,...

openjdk: OpenJDK: Enhance Jar file processing (Oracle CPU 2026-07)

Vulnerability in Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability...

openjdk: OpenJDK: Enhance XBM image support (Oracle CPU 2026-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.1...

openjdk: OpenJDK: Enhance Dataview Implementation (Oracle CPU 2026-07)

Vulnerability in Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful...

CVE-2026-7534

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...