CVE-2026-67103

HCL BigFix Service Management is affected by a Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject unsanitized malicious scripts executed in a victim's browser. The stated impact includes session hijacking , account takeover , and unauthorized actions on behalf of affected ...

EUVD-2026-82769

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

CVE-2026-90977 Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

CVE-2026-90977

The Clean Login WordPress plugin prior to version 1.19 fails to verify the registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving the CAPTCHA. The vulnerabili...

CVE-2026-90977 Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

EUVD-2026-82689

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2025-13882 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow an unauthenticated user to cause a denial of service in the email service due to improper control...

SUSE CVE-2026-89635

In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...

SUSE CVE-2026-93050

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

CVE-2026-67103: Improper Neutralization of Input During Web Page Generation

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

CVE-2026-81181: Session Fixation

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor...

EulerOS 2.0 SP10 : python-requests (EulerOS-SA-2026-3764)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with...

CVE-2026-21806: Undefined Security Weakness

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

PT-2026-95556

Name of the Vulnerable Software and Affected Versions versions prior to 0.9.0 Description The intra-handshake attested TLS aTLS Intel TDX verification path fails to copy the expected current-session freshness value into the TDX quote-body policy before quote validation. Consequently, structurally...

PT-2026-105503

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

CVE-2026-92701: Origin Validation Error

Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS aTLS Intel TDX verification path does not copy the expected current-session freshness value into the TDX quote-body...

CVE-2026-92976: Insufficient Session Expiration

A stored Cross-Site Scripting XSS vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered is stored and displayed without being...

PT-2026-95306

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description Cross-Site Scripting XSS allows an attacker to inject unsanitized malicious scripts that execute in a victim's browser. This can lead to session hijacking, account...

PT-2026-95350

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description An Administrative Session Concurrency issue exists where the application permits multiple simultaneous authenticated sessions for a single administrative account. This...

PT-2026-95348

Name of the Vulnerable Software and Affected Versions T-Systems TAO 2.0 affected versions not specified Description A stored Cross-Site Scripting XSS issue exists in the profile management functionality. An authenticated user can inject malicious HTML or JavaScript into personal data fields. This...