PT-2026-88500

Impact The public OIDC login and callback endpoints ran the full flow whether or not OIDC was the instance's active, enabled authentication method, so turning OIDC off in Settings did not stop it issuing sessions. An administrator who disabled the provider still had a working login route. The pat...

MAL-2026-16017 Malicious code in telegram-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90afeb1d39f1ef3d107f2da6a26c4af8c7efb314bb0f272d45fa755119e1b669 telegramhelper describes itself as "A minimal example Python library" and ships a Russian-language template README the Homepage field is still the...

Exploit for CVE-2026-36392

CVE-2026-36392: Stored XSS in RISE CRM Item Title Field Su...

Cross-site Scripting (XSS)

Overview league/commonmark is a PHP-based Markdown parser which supports the full CommonMark spec. It is based on the CommonMark JS reference implementation. Affected versions of this package are vulnerable to Cross-site Scripting XSS through AttributesHelper::filterAttributes in...

BASM (Broken Authentication & Session Management) Netty Dependency in Bitbucket Data Center and Server

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-50010 was introduced in 9.0.1 and later of Bitbucket Data Center and Server. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

Cybersecurity researchers have unpacked JSCeal , a sophisticated compiled V8 JavaScript JSC malware with credential harvesting, surveillance, and traffic-interception capabilities. "The payloads are protected with javascript-obfuscator, using multiple techniques including RC4-protected strings,...

CVE-2026-86279

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file authprocess.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack remotel...

EUVD-2026-72273

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file authprocess.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack remotel...

CVE-2026-86279 SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiation

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file authprocess.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack remotel...

CVE-2026-86279

CVE-2026-86279 affects the SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 , a learning management platform. The vulnerability resides in an unknown function within the file auth_process.php (component: Login ) and results in session fixation , allowing a remote attac...

CVE-2026-86279 SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiation

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file authprocess.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack remotel...

rxgk_extract_token Heap Buffer Overflow DoS

The vulnerability of the rxgkextracttoken function in the net/rxrpc/rxgkapp.c module, which supports RxRPC session sockets in Linux operating systems, is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacker to compromise the...

LOYTEC L-IP BACnet/IP Routers Cross-site Scripting (CVE-2026-12496)

An unauthenticated remote attacker can inject and store malicious JavaScript in the OPC XML-DA server statistics page /webui/statistics/opcsrv of a LOYTEC L-IP BACnet/IP router by sending a crafted 'User-Agent' header in a POST request to the device's '/da' endpoint. The script executes in an...

CVE-2026-86279: Session Fixation

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file authprocess.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack remotel...

PT-2026-86638

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file auth process.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the connection reuse process. An attacker can gain unauthorized access to another user's authenticated session by sending a request using empty credentials, which may be routed over a previously authenticated...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via improper handling of the Set-Cookie header when the Domain attribute matches a public suffix. An attacker can cause cookies to be sent to arbitrary sibling subdomains by setting a cookie with a domain scope tha...

CVE-2026-86215

A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the component Logout Handler. Such manipulation of the argument logout leads to session expiration. It is possible to launch the attack remotely. T...

CVE-2026-86215 Mstfakts College-Management-System Logout server.php session expiration

A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the component Logout Handler. Such manipulation of the argument logout leads to session expiration. It is possible to launch the attack remotely. T...

CVE-2026-86215

A session expiration vulnerability exists in the Logout Handler component (file Front-end/server.php) of Mstfakts College-Management-System , a self-hosted college management application on GitHub. Manipulation of the log_out argument allows a low-privileged remote attacker to force session expir...