CVE-2026-82356 Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production

Imprivata EAM =26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices...

PT-2026-97505

Name of the Vulnerable Software and Affected Versions Imprivata EAM versions prior to 26.2.7 Description The software lacks a mechanism to rotate the RSA key pair used for generating X.509 certificates after deployment. This means the key pair remains permanent once the system is deployed, which...

Enterprise Access Management EAM does not rotate RSA keys

Overview Imprivata Enterprise Access Management EAM, an authentication and single sign-on platform for enterprise and clinical environments, contains a vulnerability in versions 26.2.6 and below. The product provides no supported mechanism to rotate its RSA key pair after deployment, meaning the...

CVE-2026-82356: Inadequate Encryption Strength

Imprivata EAM =26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices...

CVE-2026-79312

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load reads sessionid directly from the request cookie and loads that session from the store, and save writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated sta...

CVE-2026-79312

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load reads sessionid directly from the request cookie and loads that session from the store, and save writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated sta...

CVE-2026-79312

The webpy web.py 0.76 framework is vulnerable to Session Fixation . The flaw exists because the Session._load() component reads the session_id directly from the request cookie to load sessions from the store, while the _save() method writes back using that same ID. Because there is no rotation of...

EUVD-2026-84489

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load reads sessionid directly from the request cookie and loads that session from the store, and save writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated sta...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2 because the full user object is stored in a client-side signed cookie . The application's authentication mechanism only verifies that a user object can be retrieved from the cookie without re-validating against the database or checking a session ve...

CVE-2026-73463 Security Advisory 0169

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface gNSI transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized...

CVE-2026-73463: Concurrent Execution using Shared Resource with Improper Synchronization

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface gNSI transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized...

MAL-2026-16197 Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16198 Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lpulogin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45e20ac78f11be43827182fe0907a1ca21cc0886163235aa9c5aeaae37ce8e88 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16161 Malicious code in meraz-project-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3081e87039a0a1582330f353797d15ba12cdb1c17828ab2ee7224b7c1ac4809 On npm install, the declared postinstall script bin/postinstall.js runs trackProject, which collects the installer's hostname, OS username,...

MAL-2026-16160 Malicious code in lpulogin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45e20ac78f11be43827182fe0907a1ca21cc0886163235aa9c5aeaae37ce8e88 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in meraz-project-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3081e87039a0a1582330f353797d15ba12cdb1c17828ab2ee7224b7c1ac4809 On npm install, the declared postinstall script bin/postinstall.js runs trackProject, which collects the installer's hostname, OS username,...