CVE-2026-77130 Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

TYPO3-EXT-SA-2026-015: Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.20.35 security and extras update

Red Hat OpenShift Container Platform release 4.20.35 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...

Improper Input Validation

Keycloak is vulnerable to Improper Input Validation. The vulnerability is due to the HTTP parameter pollution check ignoring the fragment portion of wildcard redirect URIs, allowing an attacker to inject duplicate security parameters that may cause improperly configured clients to trust...

Token Revocation Bypass

Keycloak is vulnerable to a token revocation bypass vulnerability. The vulnerability is due to an application-specific “not-before” token revocation policy being silently ignored when an older, non-zero realm-level policy exists, which allows an attacker to continue using previously issued tokens...

[BSA-137] Security Update for sabnzbdplus

Jeroen Ploemen uploaded new packages for sabnzbdplus which fixed the following security problem: In sabnzbdplus = 5.1.0, an attacker with access to the password-protected web interface can bypass the authentication and obtain a valid session without knowing the username or password...

Ebyte NE2-D11

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized administrative access, disclose sensitive information, modify device configuration, hijack authenticated sessions, and disrupt device operation. 2. RECOMMENDED PRACTICES CISA recommends...

SUSE CVE-2026-23933

In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid...

CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

CVE-2026-34959 Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...

SUSE CVE-2026-68455

In the Linux kernel, the following vulnerability has been resolved: liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVEFD is only applicable to outgoing sessions. RETRIEVEFD and FINISH are only valid for incoming...

curl: TLS session cache case-folds CA paths and bypasses the active trust profile

curl 8.21.0 case-folds the entire TLS session-cache peer key, so two distinct CA files whose Unix paths differ only by case can share a TLS session ticket. At lib/vtls/vtlsscache.c:723, curlstrequal compares keys that include case-sensitive CA, CRL, and issuer paths, even though...

Linux Kernel RxRPC recvmsg DoS

The vulnerability of the rxrpcrecvmsg function in the net/rxrpc/recvmsg.c module, which supports RxRPC session sockets in Linux kernels, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

Linux Kernel RxRPC Function Heap Buffer Overflow DoS

The vulnerability of the rxgkverifyresponse function in the net/rxrpc/rxgk.c module, which is part of the RxRPC session support for Linux kernel sockets, involves a numerical overflow vulnerability. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity...

net/rxrpc/rxgk.c Kernel Session Compromise

The vulnerability of the rxgkdoverifyauthenticator function in the net/rxrpc/rxgk.c module relates to the execution of operations outside of the buffer in the memory of the Linux operating system’s kernel. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and...

RockyLinux 9 : python-urwid (RLSA-2026:58952)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58952 advisory. urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure CVE-2026-9323 Tenable has extracted the preceding description bloc...

RHEL 8 : python-urwid (RHSA-2026:59198)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:59198 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

AlmaLinux 9 : python-urwid (ALSA-2026:58952)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:58952 advisory. urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure CVE-2026-9323 Tenable has extracted the preceding description block...

CVE-2026-73180: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-79665: Missing Authorization

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...