PT-2026-96773

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session. load reads session id directly from the request cookie and loads that session from the store, and save writes back under the same session id; no rotation after authentication, so a fixed session id keeps the authenticated...

CVE-2026-79312

The webpy web.py 0.76 framework is vulnerable to Session Fixation . The flaw exists because the Session._load() component reads the session_id directly from the request cookie to load sessions from the store, while the _save() method writes back using that same ID. Because there is no rotation of...

CVE-2026-79312: Session Fixation

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load reads sessionid directly from the request cookie and loads that session from the store, and save writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated sta...

CVE-2026-79312

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load reads sessionid directly from the request cookie and loads that session from the store, and save writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated sta...

PT-2026-96809

Name of the Vulnerable Software and Affected Versions Lantronix SLC8000 affected versions not specified Lantronix SLC9000 affected versions not specified Lantronix EMG8500 affected versions not specified Lantronix EMG7500 affected versions not specified Lantronix SLB882 affected versions not...

CVE-2026-79313

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can...

PT-2026-96986

Name of the Vulnerable Software and Affected Versions Adobe Connect affected versions not specified Description A stored Cross-Site Scripting XSS issue exists where an attacker can inject malicious scripts into vulnerable form fields. When a victim visits the page containing the affected field, t...

PT-2026-96736

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A stored cross-site scripting XSS issue exists in the admin email composition screen. The organization name setting is interpolated directly into a JavaScript string literal using an unescaped P...

PT-2026-96709

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.14.0 through 0.16.1 Description Improper validation of the specified quantity in the input allows a client with an open payment channel to obtain paid resources without being charged. The function accept voucher/3 in...

CVE-2026-75517: Authorization Bypass Through User-Controlled Key

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...

PT-2026-97022

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 2.4.37 Nautobot versions prior to 3.1.8 Description Users with specific permissions can store HTML or JavaScript in a Relationship description or a Module Family name. Nautobot assigns these values to form field help...

CVE-2026-86698: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generaterefreshtoken/4 in...

CVE-2026-75510: Improper Neutralization of Input During Web Page Generation

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

PT-2026-97108

Name of the Vulnerable Software and Affected Versions Mstfakts College-Management-System affected versions not specified Description A flaw in the Authentication component allows for remote session fixation. This occurs within the session start function located in the Front-end/server.php file...

PT-2026-96829

Name of the Vulnerable Software and Affected Versions hex.pm versions 2025-10-10 through 2026-09-21 Description An insufficient session expiration issue in OAuth token issuance allows users whose organization membership or session has ended to continue reading private packages and documentation...

PT-2026-97042

Name of the Vulnerable Software and Affected Versions Autonomy Logic OpenPLC version 3 Description An improper neutralization of input during web page generation occurs in the web interface when routing programs based on a query string parameter that is not encoded. This cross-site scripting XSS...

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

EUVD-2026-84490

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can...

CVE-2026-79313

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can...

PT-2026-96723

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A reflected cross-site scripting XSS issue exists in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a...