PT-2026-87121

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...

CVE-2026-84869: Missing Authorization

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

CVE-2026-86674: Session Fixation

A vulnerability was found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is the function sessionstart of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has...

CVE-2026-28611: Missing Authorization

In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-76196: Session Fixation

Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain access to sensitive resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user...

CVE-2026-78550: Improper Neutralization of Directives in Dynamically Evaluated Code

The Okta Access Gateway management console passes user-supplied input to eval without sanitization during an authenticated administrator SSH session. As a result, the unsanitized input is executed directly, leading to code execution with the privileges of the management console...

CVE-2026-86721: Improper Authentication

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $REQUEST'key' parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the...

CVE-2026-66767: Integer Underflow (Wrap or Wraparound)

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

PT-2026-88427

Name of the Vulnerable Software and Affected Versions Okta Access Gateway affected versions not specified Description The management console passes user-supplied input to the eval function without proper sanitization during an authenticated administrator SSH session. This allows the unsanitized...

PT-2026-87939

Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain access to sensitive resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user...

PT-2026-88169

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

PT-2026-88279

A vulnerability was found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is the function session start of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has...

PT-2026-88268

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Magento Open Source affected versions not specified Adobe Commerce B2B affected versions not specified Description Stored Cross-Site Scripting XSS occurs when an application stores unsanitized use...

PT-2026-87006

Name of the Vulnerable Software and Affected Versions Reyrolle 7SR5 versions prior to V2.70 Description An issue exists where a random number generator used for security-relevant values, such as session identifiers for authentication, is not initialized with a True Random Number Generator TRNG...

CVE-2026-62645: Missing Authentication for Critical Function

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device...

VulnCheck KEV: CVE-2026-84869

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation...

CVE-2026-84869: Missing Authorization

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

CVE-2026-62646: Insufficient Entropy

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

PT-2026-88449

The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering SSR environment where module state persists across HTTP requests. Under the listed preconditions, tokens cached in module memory...

MAL-2026-16017 Malicious code in telegram-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90afeb1d39f1ef3d107f2da6a26c4af8c7efb314bb0f272d45fa755119e1b669 telegramhelper describes itself as "A minimal example Python library" and ships a Russian-language template README the Homepage field is still the...