EUVD-2026-68324

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

Moderate: dbus-broker security update

dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features...

PT-2026-84032

Name of the Vulnerable Software and Affected Versions QuantumNous new-api versions prior to 1.0.0-rc.17 Description A remote manipulation of the Revoked API Token Handler component within the '/api/usage/token/' endpoint can lead to session expiration. Recommendations Upgrade to version 1.0.0-rc....

ALSA-2026:61340 Moderate: dbus-broker security update

dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features...

CVE-2026-82816: Authorization Bypass Through User-Controlled Key

A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been...

CVE-2026-75757: Reliance on Cookies without Validation and Integrity Checking

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-82909: Insufficient Session Expiration

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

ALSA-2026:61355 Moderate: dbus-broker security update

dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems, and makes use of many modern features...

PT-2026-83788

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 9.1.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 Description The ResourceIsolationRequestCycleListener fails to properly protect applications against cross-site request forgery due to unsafe allowances ...

PT-2026-83940

A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been...

PT-2026-84903

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.30.0 Description Uninitialized heap memory is transmitted in the reserved padding fields of the Save Session Info PDU. This occurs because three PDU writers in libfreerdp/core/info.c rdp write logon info v2, rd...

PT-2026-83676

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant, actor...

RHEL 10 : dbus-broker (RHSA-2026:61340)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:61340 advisory. dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability,...

RHEL 9 : dbus-broker (RHSA-2026:61355)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:61355 advisory. dbus-broker is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability, whi...

Media Session DoS

The vulnerability of the Media Session component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the request. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially crafted HTML page...

PT-2026-83808

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function session start. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity...