[SECURITY] Fedora 44 Update: rubygem-mechanize-2.14.1-1.fc44

The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, can follow links, and submit forms. Form fields can be populated and submitted. Mechanize also keeps track of the sites that you have visited as a history...

CVE-2026-82970

Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1...

EUVD-2026-68575

Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1...

CVE-2026-82970

CVE-2026-82970 is an Unrestricted File Upload vulnerability in the WordPress plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (by WP Legal Pages), affecting versions through 4.4.1 . Discovered by Jiemook , the flaw allows an unauthenticated attacker to upload a malicious file over the ne...

CVE-2026-82970 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1...

CVE-2026-82970 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1...

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Jiemook in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.4.1...

CVE-2026-82697

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function sessionstart. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity...

CVE-2026-82697 sambitraj Student-Management-System session_start cookie httponly flag

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function sessionstart. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity...

CVE-2026-82697

CVE-2026-82697 affects the sambitraj Student-Management-System (a rolling-release GitHub project) up to commit 56ba287. The vulnerable component is the session_start function, which sets a session cookie without the httponly flag , allowing JavaScript access to the session cookie. The attack is r...

CVE-2026-82697 sambitraj Student-Management-System session_start cookie httponly flag

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function sessionstart. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity...

CVE-2026-82697 sambitraj Student-Management-System session_start cookie httponly flag

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function sessionstart. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity...

EUVD-2026-68487

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requests that a resource isolation policy judges to come from another origin. Its default policy, FetchMetadataResourceIsolationPolicy, was derived from a reference implementation...

CVE-2026-75757

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

MAL-2026-15602 Malicious code in redis-cookie-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c94026a508b2ada8c891551c8ccd622f86c2ba2e7b6a7c181fc3eb538e2f1f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in redis-cookie-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c94026a508b2ada8c891551c8ccd622f86c2ba2e7b6a7c181fc3eb538e2f1f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

EEF-CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Summary Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757

ash_admin (ash-project) is vulnerable to session/actor shadowing via a flawed client-side cookie reader. The JavaScript reads state cookies (e.g., actor_authorizing, actor_domain) using an unanchored regex (new RegExp(name + "=([^;]+)")) against document.cookie, so any cookie whose name merely en...