CVE-2026-97055: Initialization of a Resource with an Insecure Default

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...

PT-2026-98267

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware generates session identifiers using a small sequential value space instead of an unpredictable source. An unauthenticated attacker with adjacent network access and knowledg...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124492)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124492 advisory. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake...

CVE-2026-57179: Session Fixation

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted partialtoken as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could all...

automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout HTML view via ANSI OSC 8 hyperlink sequences (javascript: anchor) enabling session takeover

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

Malicious code in @rixxcodex/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58b5247e2f10d09b51e8d59c4b36cb2cbe62909af4be588fdb07dabf0afabcf2 This package is a fork of the Baileys WhatsApp library that adds three undocumented channels which use the installer's authenticated WhatsApp session...

GHSA-GVF2-2RH5-MPGF OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Summary A user who can save a telemetry screen permission systemset can embed JavaScript in a screen BUTTON widget. The BUTTON widget evals the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an...

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

Summary A user who can save a telemetry screen permission systemset can embed JavaScript in a screen BUTTON widget. The BUTTON widget evals the stored button text in the browser when the button is activated, and screens are shared content rendered to other users in the scope. As a result, an...

CVE-2026-75886

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout HTML view via ANSI OSC 8 hyperlink sequences (javascript: anchor) enabling session takeover

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

CVE-2026-75886 Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

CVE-2026-75886 Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

CVE-2026-75886

A flaw in openshift/console allows an unauthenticated remote attacker to exploit a misconfiguration in the CatalogdHandler . Because the handler lacks proper authentication and forwards the openshift-session-token cookie, an attacker can send requests to the in-cluster catalogd service. This resu...

EUVD-2026-85665

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

CVE-2026-75886

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

DEBIAN-CVE-2026-77422

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep... and, unless line-regexp mode is used, automatically adds ...

CVE-2026-77422

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep... and, unless line-regexp mode is used, automatically adds ...

CVE-2026-84683 Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling session takeover

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

CVE-2026-84683 Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling session takeover

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...