PT-2026-94249

Name of the Vulnerable Software and Affected Versions admin3 version 3.0.0 Description User session tokens are persisted in the audit log event body during the publishing of UserLoggedIn domain events. An attacker with log:view permission can access these tokens by reading the JSON response from...

PT-2026-95064

Name of the Vulnerable Software and Affected Versions TS3 Manager versions prior to 2.2.6 Description The /api/download endpoint in packages/server/routes/api.js improperly handles the port query parameter, passing it to the socket.connectport, host function and returning the resulting error...

PT-2026-94357

Name of the Vulnerable Software and Affected Versions HUBzero CMS versions prior to 2.2.33 Description The software accepts session identifiers from query strings and request variables instead of relying exclusively on cookies. This allows unauthenticated attackers to perform session fixation,...

CVE-2026-86688: Session Fixation

Session Fixation vulnerability in team-alembic ashauthentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.storeinsession/2 writes the authenticated subject into the existi...

CVE-2026-81637: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

CVE-2026-90154: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...

PT-2026-95161

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.10.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description An authentication bypass by spoofing allows an attacker to replace a victim's authenticated session with their own account...

PT-2026-94293

Name of the Vulnerable Software and Affected Versions ash authentication versions 0.6.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description Insufficient session expiration allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sig...

PT-2026-94301

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.9.1 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 ash authentication phoenix versions 2.10.0 through 2.17.3 ash authentication phoenix versions 3.0.0-rc.0 through 3.0.0-rc.10 Descriptio...

PT-2026-95051

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...

PT-2026-94353

Name of the Vulnerable Software and Affected Versions Sanic versions prior to 24.12.1 Sanic version 25.12.0 Description The HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. This allows...

CVE-2026-85077: Improper Neutralization of CRLF Sequences in HTTP Headers

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...

CVE-2026-54644: Improper Neutralization of Input During Web Page Generation

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

PT-2026-95152

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description The errorMessage function in classes/gui.class.php uses strip tags to allow anchor elements in error, information, and warning messages. However, it fails to filter unsafe href values and onclick...

PT-2026-94500

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A session leak occurs in the ksmbd session register function. When the xa store function fails during the session registration process, the session is not properly removed from the...

PT-2026-95008

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A stored cross-site scripting XSS issue exists in the Overmind theme's statistics views. The event General card event general.ctp and the server/feed preview card preview general.ctp create donu...

PT-2026-94204

Name of the Vulnerable Software and Affected Versions Nuevector affected versions not specified Description Users authenticated through SAML or OpenID Connect OIDC may experience a session mix-up where one user receives another user's authenticated session. This occurs when multiple Single Sign-O...

CVE-2026-78428: Session Fixation

For users authenticated through SAML or OpenID Connect OIDC, this vulnerability can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently...

SUSE CVE-2026-9679

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 5.4 does not specify any decoding and browsers do not decode either. Applications that parse a...

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

Summary An unauthenticated remote attacker can leak one entry per HTTP request out of the in-memory session table of LocalSessionManager by sending a well-formed JSON-RPC POST that is not an InitializeRequest. The Streamable HTTP server's handlepost allocates the session before it validates the...