CVE-2026-87445

UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87445

UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-87445

The Chromium web browser (prior to version 153.0.8010.36 ) is vulnerable to a UI misrepresentation in Session . A remote attacker can exploit this by using a crafted HTML page to spoof UI elements . This vulnerability has been addressed in several distributions, including Debian 12 bookworm (fixe...

PT-2026-89109

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.7 Description The software contains a hardcoded session encryption key within the application/config/config.php file that remains unchanged after installation. This allows unauthenticated attackers to forge...

PT-2026-88935

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to session theft...

CVE-2026-71801

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

PT-2026-89162

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.27 through 0.11.0 Description An issue exists in the tool loading routine within backend/open webui/utils/tools.py where a cookie jar is captured from the enclosing connection loop instead of being bound to each externa...

PT-2026-89167

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.41 through 0.11.0 Description On SQLite deployments, the lookup process mapping an external identity to a local account performs a substring match instead of an exact match. This occurs because the contains operator on...

CVE-2026-80174: Insufficient Session Expiration

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to session theft...

SAP NetWeaver Memory Corruption (3757002)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3757002: - SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that...

PT-2026-88994

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call session regenerate id afterward. As a result, the session identifier is not...

CVE-2026-86755: Incorrect Authorization

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-64857: Session Fixation

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

CVE-2026-86744: Concurrent Execution using Shared Resource with Improper Synchronization

Snipe-IT 8.6.3 and earlier and develop pre-release commits prior to the fix contain a race condition in the asset checkout paths. Api\AssetsController::checkout and Assets\AssetCheckoutController::store call Asset::availableForCheckout outside the mutation path and then invoke Asset::checkOut...

CVE-2026-71801: Use of Hard-coded Credentials

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

CVE-2026-87016: Improper Neutralization of Wildcards or Matching Symbols

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, getuserbyoauthsub and getuserbyscimexternalid in backend/openwebui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject...

CVE-2026-87014: Insufficient Session Expiration

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/openwebui/routers/auths.py and backend/openwebui/utils/oauth.py updated an administrator's database role without invalidating the user record cached by...

CVE-2026-87445: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

SolarWinds Serv-U Authentication Bypass

The vulnerability of the software for secure file sharing and transmission of SolarWinds Serv-U is related to the ability to bypass authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely intercept sessions and gain control of the user account...

SolarWinds Serv-U Session Interception Access

The vulnerability of the software for secure file sharing and transmission related to SolarWinds Serv-U lies in the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to intercept sessions and gain access to the user account...