CVE-2026-89788 ksmbd: fix tree connection use-after-free in smb2_tree_connect()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...

CVE-2026-89788 ksmbd: fix tree connection use-after-free in smb2_tree_connect()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...

EUVD-2026-80058

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7webauthlogdumpcgi.c, auditgetcgi.c, and moddispatchauth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data...

CVE-2026-20071: Authentication Bypass by Spoofing

A vulnerability in the SSID bring-your-own-device BYOD onboarding workflow of Cisco ISE could allow an unauthenticated, adjacent attacker to hijack the onboarding session of another user and access protected 802.1X networks. This vulnerability is due to insufficient authentication checks that are...

PT-2026-94035

Name of the Vulnerable Software and Affected Versions SafeLine versions prior to 9.4.2 Description The management console session-signing secret is derived from a time-seeded math/rand generator. This allows unauthenticated remote attackers who can determine the installation timestamp to...

CVE-2026-85385: Improper Neutralization of Input During Web Page Generation

Concrete CMS below 9.5.4 did not validate the user timezone value uTimezone on write and rendered it without output encoding on the Dashboard user management page, where Date::getTimezoneDisplayName returns any non-IANA value unchanged. A stored cross-site scripting payload saved in this field...

CVE-2026-92800: Insufficient Session Expiration

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

CVE-2026-61592: Session Fixation

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped...

CVE-2026-92416: Reachable Assertion

A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smfn4handlesessionreportrequest of the file src/smf/n4-handler.c of the component PFCP Session Report Request Handler. The manipulation leads to reachable assertion. The attack may be initiated remotely...

PT-2026-93846

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.4 Description Stored cross-site scripting occurs because the software fails to validate the uTimezone value during write operations and renders it without output encoding on the Dashboard user management page...

CVE-2026-76187: Improper Authentication

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

Linux Distros Unpatched Vulnerability : CVE-2026-53660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the default configuration initializes the iPlanetDirectoryPro SSO cookie with...

PT-2026-93401

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Resetting a user password fails to delete existing database-backed sessions when using the FAB auth manager with fab session backend=database. This occurs because the cleanup...

PT-2026-93725

Name of the Vulnerable Software and Affected Versions Advantech EKI-1242EIMS version V1.06.01 Description The OPC UA gateway component contains an uncontrolled resource consumption issue. An unauthenticated adjacent attacker can open multiple anonymous sessions to exhaust the server session pool,...

PT-2026-94108

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.12 Description A failure in the database connection is incorrectly interpreted as the software not being installed. This allows anonymous installer actions, such as install/validate-site, to be accessed on...

Robot Visions: Breaking ReCAPTCHA at Zero Cost and Zero Shot

Google reCAPTCHA is the most widely deployed visual CAPTCHA service, protecting hundreds of thousands of websites from automated bots. It serves as a critical line of defense against automated attacks, including credential stuffing, bulk account creation, and automated form abuse. It has proven...

CVE-2026-92616: Insufficient Session Expiration

FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access by exploiting improper session isolation between the WebDAV interface and the web application session context. Attackers can...

PT-2026-93816

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.28.0 Description Improper session isolation between the WebDAV interface and the web application session context allows authenticated low-privilege attackers to gain unauthorized read and write access. By combining...

PT-2026-94001

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue exists in the Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software. This flaw results from improper management of th...

CVE-2026-86462: Insufficient Session Expiration

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...