CLEANSTART-2026-GK10237 Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does

CVE-2026-82311 affects multiple packages. Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. See references for individual vulnerability details...

CVE-2026-91161: Incorrect Authorization

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/sessionId/groups/groupId/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group...

CVE-2026-77422

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep... and, unless line-regexp mode is used, automatically adds ...

CVE-2026-18179

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

EUVD-2026-85325

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

CVE-2026-18179 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

CVE-2026-18179

The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to an issue where a remote attacker can clear active chat sessions. This is caused by improper authorization (CWE-862). The vulnerability impacts versions 4.0.6.0 - 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800...

CVE-2026-18179 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

CVE-2026-18179: Missing Authorization

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

PT-2026-97323

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

PT-2026-96983

Name of the Vulnerable Software and Affected Versions Adobe Connect versions prior to 12.12 Description Adobe Connect contains an SQL Injection flaw, which occurs when special elements used in an SQL command are not properly neutralized. This allows a low-privileged attacker to execute arbitrary...

SUSE CVE-2026-72810

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including...

CVE-2026-93659 Concrete CMS Community Store before 2.7.8 Stored XSS

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

CVE-2026-21806

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

CVE-2026-21806 HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

EUVD-2026-82876

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

DEBIAN-CVE-2026-90169

In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauthsession between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates...

CVE-2026-92983

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

EUVD-2026-81620

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

CVE-2026-92983: Missing Release of Resource after Effective Lifetime

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...