CVE-2026-71801: Use of Hard-coded Credentials

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

SPIP Autosave Session Unauthenticated Remote Code Execution

This Metasploit module exploits an unauthenticated RCE in SPIP less than or equal to 4.4.21 via the forum autosave session handler. The action=session endpoint allows any visitor to store arbitrary data in a PHP session variable. By writing PHP code into an autosaveforum session key, the code is...

Linux Distros Unpatched Vulnerability : CVE-2026-87445

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium securit...

PT-2026-88762

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm contact dropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-13359: Improper Neutralization of Input During Web Page Generation

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...

PT-2026-89162

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.27 through 0.11.0 Description An issue exists in the tool loading routine within backend/open webui/utils/tools.py where a cookie jar is captured from the enclosing connection loop instead of being bound to each externa...

PT-2026-89109

Name of the Vulnerable Software and Affected Versions MaxSite CMS versions prior to 109.7 Description The software contains a hardcoded session encryption key within the application/config/config.php file that remains unchanged after installation. This allows unauthenticated attackers to forge...

PT-2026-88994

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call session regenerate id afterward. As a result, the session identifier is not...

PT-2026-89167

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.41 through 0.11.0 Description On SQLite deployments, the lookup process mapping an external identity to a local account performs a substring match instead of an exact match. This occurs because the contains operator on...

CVE-2026-87016: Improper Neutralization of Wildcards or Matching Symbols

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, getuserbyoauthsub and getuserbyscimexternalid in backend/openwebui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject...

CVE-2026-80174: Insufficient Session Expiration

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to session theft...

CVE-2026-79696: Incomplete List of Disallowed Inputs

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

PT-2026-89110

MaxSite CMS through 109.6 passes the ci session cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achiev...

Security Advisory 0154

Security Advisory 0154 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73458 CVSSv3.1 Base Score: 8.2...

CVE-2026-87929: Use of Hard-coded Cryptographic Key

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious cisession cookie with administrator...

CVE-2026-64857: Session Fixation

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

SolarWinds Serv-U Session Interception Access

The vulnerability of the software for secure file sharing and transmission related to SolarWinds Serv-U lies in the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to intercept sessions and gain access to the user account...

CVE-2026-87445: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

PT-2026-88902

CVE-2026-79696: A Perfect 10.0 in Google's Agent Toolkit Google just shipped a fix for a vulnerability that scored a perfect 10.0 on the CVSS scale — the maximum severity a flaw can get. The bug lives in ADK, Google Cloud's Agent Development Kit for Python — the framework a growing number of team...

PT-2026-88935

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to session theft...