8404 matches found
CVE-2026-109369 WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, wi...
CVE-2026-109369 WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, wi...
SUSE CVE-2026-87861
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused...
SUSE CVE-2026-107929
When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...
CVE-2026-86411
A flaw was found in curl that can allow unauthorized access through improper session reuse. When an unencrypted File Transfer Protocol FTP transfer reuses a pooled connection previously authenticated with a client certificate and upgraded using Transport Layer Security TLS, curl fails to perform ...
CVE-2026-87861
A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: - net: Restricted SOREUSEPORT option for inet sockets. After the bug was identified, it was discovered that crypto sockets could accidentally be destroyed due to RCU callbacks, as noted by zyzbot 1. Attempting to acquire a mut...
Astra Linux – Vulnerability in curl
libcurl will reuse a previously established connection even when options related to TLS or SSH have been changed, which should prevent such reuses. libcurl stores previously used connections in a connection pool, allowing for reuse if one of them matches the current setup. However, several TLS an...
Astra Linux – Vulnerability in curl
libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take ‘issuercert’ into account, and it compared the involved paths case insensitively, which could...
Astra Linux – Vulnerability in liblivemedia
Live555 before 2019.08.16 has a Use-After-Free issue, as GenericMediaServer::createNewClientSessionWithId can generate the same client session ID consecutively. This issue is handled improperly by the MPEG1or2 and Matroska file demultiplexors...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: smb: client: fixed the issue where krb5 mounts failed when the client tried to mount shares with incorrect credentials. It turned out that the client was reusing the SMB session from the first mount attempt, even though a differe...
CLEANSTART-2026-UA66852 In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver
Security vulnerability affects the elasticsearch package. In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver...
Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2025-36069
Summary The Web UI and REST interfaces did not properly invalidate active user sessions after security-sensitive account changes, including password changes, password resets, or role and privilege updates, allowing previously issued session tokens to remain valid and potentially be reused to acce...
Linux Distros Unpatched Vulnerability : CVE-2026-55167
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with...
DEBIAN-CVE-2026-55167
LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...
CVE-2026-55167
LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...
curl: curl: cross-origin reuse of a Negotiate connection
A flaw was found in curl. When ambient user credentials—where authentication is handled implicitly without providing a username—are used, curl may improperly reuse an existing connection authenticated via Negotiate for a different server origin. This improper connection reuse can cause requests...
curl: curl: FTP connection reuse inherits client-certificate
A flaw was found in curl that can allow unauthorized access through improper session reuse. When an unencrypted File Transfer Protocol FTP transfer reuses a pooled connection previously authenticated with a client certificate and upgraded using Transport Layer Security TLS, curl fails to perform ...
CURL-CVE-2026-86411 FTP connection reuse inherits client-certificate
An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...
CURL-CVE-2026-107929 local interface connection reuse mixup
When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...