CVE-2026-100655

A flaw was found in Netty. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exhausting server memory. Because the SPDY session handler does not restrict the number of concurrent streams initiated by a remote peer, an attacker can transmit an excessive volume of stre...

CVE-2026-84652

A flaw was found in Jenkins. When a user authenticates using the "remember me" cookie, Jenkins fails to rotate the session identifier. This oversight allows a remote attacker, who can serve content on the same site as Jenkins, to set a known session cookie in a victim's browser. Consequently, onc...

Exploit for CVE-2026-85984

CVE-2026-85984 — miniOrange OTP Login Auth Bypass Python 3...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

[SECURITY] Fedora 45 Update: cinnamon-session-6.7.5^unstable-1.fc45

Cinnamon-session manages a Cinnamon desktop or GDM login session. It starts up the other core components and handles logout and saving the session...

PT-2026-102367

Name of the Vulnerable Software and Affected Versions proxygen versions 2026.04.06.00 through 2026.09.28.00 Description A use-after-free issue exists where the QuicWtSession::closeSession function accesses member fields after invoking the base QuicWtSessionBase::closeSession method. Because the...

PT-2026-99866

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

CVE-2026-82933: Undefined Security Weakness

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

CVE-2026-88805: Insufficient Session Expiration

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

CVE-2026-52749: Improper Authentication

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perfor...

PT-2026-99879

Name of the Vulnerable Software and Affected Versions Kaon AR2140X versions prior to 4.2.18 Description The router improperly issues session cookies in responses to unauthenticated HTTP requests. This allows a remote attacker to obtain a valid session identifier without providing credentials,...

CVE-2026-101891: Improper Access Control

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session...

PT-2026-102410

Name of the Vulnerable Software and Affected Versions mall4j versions prior to 4.1 Description An insufficient session expiration issue exists in the token refresh mechanism. The system fails to validate the enabled flag when issuing new sessions, allowing disabled user accounts to indefinitely...

PT-2026-99936

Name of the Vulnerable Software and Affected Versions WatchGuard Access Points affected versions not specified Description An improper access control issue exists within an internal API service. This allows an unauthenticated attacker with network access to the access point to obtain a valid API...

Fedora 45 : cinnamon / cinnamon-desktop / cinnamon-session / etc (2026-c4d5a488fe)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-c4d5a488fe advisory. - Update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but...

RHEL 9 : git-lfs (RHSA-2026:72276)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:72276 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...

CVE-2026-94422

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

AZL-105185 CVE-2026-94419 affecting package mariadb 10.11.19-1

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

DEBIAN-CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...