EUVD-2026-75777

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation...

EUVD-2026-75870

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

CVE-2026-81906

Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a session that was fully...

PT-2026-90523

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An improper access control issue exists in a deployment mode designed to provide read-only access to a bundled packet-analysis component's interface. The system...

PT-2026-90351

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where the ksmbd reopen durable fd function incorrectly rebinds all detached oplocks on an inode to a reconnecting session instead of only the oplock...

PT-2026-90367

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the handle session function when decoding MDSCapAuth records within a CEPH SESSION OPEN message. The function uses ceph decode copy to read the match.path...

CVE-2026-81917: Improper Neutralization of Input During Web Page Generation

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-50025: Exposure of Sensitive Information to an Unauthorized Actor

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse MAM session...

CVE-2026-90454: Missing Authorization

A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but the pattern omits routes that modify tags attached to stored session records, and the proxy configuration otherwise permits the request...

CVE-2026-81906: Authentication Bypass Using an Alternate Path or Channel

Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establishing a session. A deactivated or unvalidated user with an existing OAuth binding could complete authentication and receive a session that was fully...

VulnCheck KEV: CVE-2025-25252

An Insufficient Session Expiration vulnerability CWE-613 in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker e.g. a former admin whose account was removed and whose session was terminated in possessi...

PT-2026-90405

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the nfsd component where the nfsd4 sequence function may free a session slot that is currently being processed. This occurs during a session shrink operation when se...

PT-2026-90051

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom slot save template endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

PT-2026-90370

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the ceph component of the Linux kernel within the check new map function. The function iterates through mdsc-sessions and releases mdsc-mutex to...

PT-2026-90424

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the nfsd component during session teardown. After a DESTROY SESSION operation, the teardown path may free a session while the rpciod still holds an...

Linux Distros Unpatched Vulnerability : CVE-2026-88017

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy drive...

Apache Artemis 1.0.0 < 2.45.0 / 2.50.0 < 2.57.0 Multiple Vulnerabilities

The version of Apache Artemis formerly Apache ActiveMQ Artemis installed on the remote host is affected by multiple vulnerabilities: - An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously...

CVE-2026-81911: Improper Neutralization of Input During Web Page Generation

Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The customslot savetemplate endpoint authorizes the request only against the target board instance canEditBoardContents and then persists the client-supplied selectedTemplateOptioncollection verbatim,...

ConnectWise ScreenConnect < 26.6.5 Missing Authorization

According to its version, the ConnectWise ScreenConnect remote access software installed on the remote host is prior to 26.6.5. It is, therefore, affected by a missing authorization vulnerability: - A condition in the ScreenConnect client may allow files to be transferred and executed through an...

PT-2026-90511

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding. This issue does not require...