5028 matches found
EUVD-2026-49180
An access control vulnerability in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active,...
CVE-2026-12990
CVE-2026-12990 describes an access-control vulnerability in Ghost Robotics’ Vision 60 mobile app (APK v5.5.0). The issue allows multiple simultaneous sessions without proper client validation or session integrity checks, enabling a modified app to connect during an active legitimate session. Impa...
CVE-2026-13332
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...
CVE-2026-13332 Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...
CVE-2026-13332
The Masteriyo LMS WordPress plugin versions prior to 2.3.1 is vulnerable to an unauthenticated arbitrary user session termination (Denial of Service). The root cause is an improper authorization check on an unauthenticated AJAX action designed to clear user sessions. This flaw allows an unauthent...
EUVD-2026-49070
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...
PT-2026-64837
The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...
Linux Distros Unpatched Vulnerability : CVE-2026-13061
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information ...
PT-2026-64896
An access control vulnerability in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active,...
Linux Distros Unpatched Vulnerability : CVE-2026-16730
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably SOPEERPIDFD are handled as...
PT-2026-64610
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ksmbd module where the ksmbd auth ntlmv2 function derives the NTLMv2 session key into sess-sess key before verifying the NTLMv2 response. Subsequently, ksmbd decod...
CVE-2026-66027
Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...
CVE-2026-64255
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate stamask before ffs in BA session handlers Three BA session handlers use ffsbadata-stamask - 1 to derive a station ID without checking that stamask is non-zero. When stamask is zero, ffs returns 0 and...
CVE-2026-15614
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...
CVE-2026-15614 IdP-initiated SAML sessions not reliably invalidated (replay)
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...
PT-2026-64018
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...
n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook
Impact The DELETE /$restEndpoint/test-webhook/:id route is registered before the authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress te...
UBUNTU-CVE-2026-13061
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...
CVE-2026-13061
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...
CVE-2026-13061 Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage
An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...