PT-2026-92429

Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description On platforms running Arista EOS with authenticated Bidirectional Forwarding Detection BFD sessions configured, a specially crafted packet can cause these sessions to crash or go down. This...

PT-2026-93116

The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space...

PT-2026-93189

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7 web auth log dump cgi.c, audit get cgi.c, and mod dispatch auth/plan.json. Attackers can query these audit components to obtain other users' session and browsing histo...

PT-2026-92019

Name of the Vulnerable Software and Affected Versions phosphor-net-ipmid affected versions not specified Description A logic flaw in the IPMI implementation of OpenBMC allows the authorization context of an active session to be replaced with a target account. This occurs while the original...

CVE-2026-81899: Improper Neutralization of Input During Web Page Generation

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...

CVE-2026-88262: Insufficient Session Expiration

Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick: R2, R3, and R3.1...

CVE-2026-63695: Improper Access Control

Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session Fixation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Session theft...

PT-2026-99159

Summary @zereight/mcp-gitlab exposes GitLab to an LLM agent while relying on read-only mode, a project allow-list, and transport auth as its safety controls. Five defects defeat those controls. Under the MCP threat model, tool-call arguments/content can be shaped by untrusted input prompt injecti...

PT-2026-91848

Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick: R2, R3, and R3.1...

CVE-2026-69214: Session Fixation

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-66887: Missing Authorization

The affected products are missing authorization on state-changing CGIs and session checks are not performed...

PT-2026-91924

Session fixation vulnerability in Secomea GateManager webserver module allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above...

CVE-2026-1758: Session Fixation

Session fixation vulnerability in Secomea GateManager webserver module allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above...

PT-2026-92030

Name of the Vulnerable Software and Affected Versions Dell SmartFabric OS10 Software versions prior to 10.6.1.3 Description An unauthenticated attacker with remote access can exploit a Session Fixation issue, which occurs when an application fails to assign a new session ID after a user...

ROS-20260915-73-0027

The vulnerability of the Media Session component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the request. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially crafted HTML page...

PT-2026-92426

The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains...

PT-2026-92122

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...

CVE-2026-55617: Insufficient Session Expiration

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-92062: Improper Privilege Management

Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

CVE-2026-18111: Missing Authentication for Critical Function

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...