Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the password reset process. An attacker can gain unauthorized access to a user's account by reusing a previously obtained password reset token within its validity period, even after the user has change...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the password reset process. An attacker can gain unauthorized access to a user's account by reusing a previously obtained password reset token within its validity period, even after the user has change...

Fleet: Password reset tokens remain valid after password change for 24 hours

Summary A vulnerability in Fleet’s password management logic could allow previously issued password reset tokens to remain valid after a user changes their password. As a result, a stale password reset token could be reused to reset the account password even after a defensive password change...

CVE-2026-25101 Session Fixation in Bludit

Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in version 3.17.2...

CVE-2026-33729

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. In versions prior to 1.13.1, under specific conditions, models using conditions with caching enabled can result in two different check requests producing the same cache...

PT-2026-28346

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0 Description Fleet’s password management logic had a flaw that allowed previously issued password reset tokens to remain valid even after a user changed their password. This meant a stale token could be reused to...

OpenFGA 安全漏洞

OpenFGA is an open-source authorization/licensing engine built for developers, inspired by Google Zanzibar. Versions of OpenFGA prior to 1.13.1 contained a security vulnerability. This vulnerability arises from models that enable caching, which may generate the same cache keys under certain...

The vulnerability of the bcm_qspi_probe() function in the drivers/spi/spi-bcm-qspi.c file of the Linux kernel’s SPI device driver allows a hacker to cause a service failure.

The vulnerability of the bcmqspiprobe function in the drivers/spi/spi-bcm-qspi.c file of the Linux kernel’s SPI device driver relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the octepvf_request_irqs() function in the drivers/net/ethernet/marvell/octeon_epvf/octepvf_main.c file of the Ethernet network adapter driver for the Marvell-based Linux operating system allows a hacker to cause a service failure.

The vulnerability of the octepvfrequestirqs function in the drivers/net/ethernet/marvell/octeonepvf/octepvfmain.c file of the Ethernet network adapter driver for the Marvell-based Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability coul...

AVideo has Plaintext Video Password Storage

Summary AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database via SQL injection, a database backup, or misconfigured access...

GHSA-363V-5RH8-23WG AVideo has Plaintext Video Password Storage

Summary AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database via SQL injection, a database backup, or misconfigured access...

CVE-2026-20991

Improper privilege management in ThemeManager prior to SMR Mar-2026 Release 1 allows local privileged attackers to reuse trial contents...

CVE-2026-31875

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.7 and 8.6.33, when multi-factor authentication MFA via TOTP is enabled for a user account, Parse Server generates two single-use recovery codes. These codes are intended as...

OpenClaw has an unspecified vulnerability (CNVD-2026-16385)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw has a security vulnerability that can be exploited by an attacker to cause reuse of pairing approvals across multiple accounts...

The vulnerability of the vp_vdparemove() function in the drivers/vdpa/virtiopci/vp_vdpa.c driver of the vDPA device drivers in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the vpvdparemove function in the drivers/vdpa/virtiopci/vpvdpa.c driver for vDPA devices in the Linux operating system is related to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the __nvmet_reqComplete() function in the drivers/nvme/target/core.c module of the NVME kernel of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nvmetreqComplete function in the drivers/nvme/target/core.c module of the NVME kernel of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

libpng 资源管理错误漏洞

Libpng is an open-source PNG reference library developed by The PNG Development Group, which allows for the creation, reading, and other operations on PNG graphic files. Versions of Libpng prior to 1.6.55 contained a resource management vulnerability. This vulnerability stemmed from aliases and...

The vulnerability of the dlm_midcomms_commit_mhandle() function in the fs/dlm/midcomms.c module exposes the security of block devices in Linux distributed computing environments, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the dlmmidcommscommitmhandle function in the fs/dlm/midcomms.c module, which is part of the Linux kernel’s distributed locking mechanism, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...

libsoup 安全漏洞

Libsoup is a GNOME project’s HTTP client/server library. Libsoup has a security vulnerability that stems from the premature release of connection objects in the soupserverdisconnect function. This can lead to reuse of released objects, potentially causing server crashes and denial-of-service...

PT-2026-28515

Name of the Vulnerable Software and Affected Versions OpenFGA versions prior to 1.13.1 Description OpenFGA is a high-performance and flexible authorization/permission engine. Under specific conditions, models using conditions with caching enabled can result in two different check requests produci...