CVE-2026-104469 YesWiki before 4.6.7 Session Fixation via Login in AuthController.php

YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki- session cookie can reuse it after login to access private...

CVE-2026-104469 YesWiki before 4.6.7 Session Fixation via Login in AuthController.php

YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki- session cookie can reuse it after login to access private...

EUVD-2026-91480

YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki- session cookie can reuse it after login to access private...

CVE-2026-104469

YesWiki versions prior to 4.6.7 are susceptible to a session fixation vulnerability. The root cause is that the application fails to regenerate the PHP session ID during the login process. An attacker who obtains or sets a victim's pre-authentication YesWiki- * session cookie can reuse that cooki...

Security Bulletin: IBM Cyber Fraud includes components with multiple known vulnerabilities

Summary IBM Cyber Fraud includes components with known vulnerabilities. These have been addressed in release 1.1.0. Vulnerability Details CVEID:CVE-2026-9825 DESCRIPTION: IBM Cyberfraud has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections,...

axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization

A flaw was found in Axios. A remote attacker or an unresponsive endpoint can cause a Denial of Service DoS by triggering an error during HTTP/2 session initialization or reuse. Because the underlying session fails to register proper error handlers, network or session failures result in an uncaugh...

httpd: httpd: Information disclosure via session cookie leakage during internal redirects

A flaw was found in Apache HTTP Server's modsessioncookie module. When internal redirects alter the SessionCookieRemove configuration, the server may fail to strip the session cookie as expected. This issue can lead to information disclosure by inadvertently forwarding sensitive user session toke...

CVE-2026-97637

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

EUVD-2026-91259

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

CVE-2026-97637 JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

CVE-2026-97637

The JSON API Auth plugin for WordPress (versions up to and including 3.1.2 ) is vulnerable to an Authentication Bypass via cached session cookie disclosure. The root cause is that the required PI-Media/json-api parent plugin caches controller dispatch results using only the URI and query string, ...

Exploit for CVE-2026-19660

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

Exploit for CVE-2026-14378

CVE-2026-14378 — DevKit Pro authentication bypass PoC Proof-o...

CVE-2026-104480

Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An attacker in control of the DAVE signaling path the voice gateway, or an equivalent position able to add, alter, or withhold signaling messages to a client...

Zoho manageengine - Cross-Site Scripting

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...

EUVD-2026-91114

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

EUVD-2026-91115

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

EUVD-2026-91127

deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regeneratelastturn. A remote caller can enumerate or obtain a sessionid and trigger regenerate on another user's session...