CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

USN-8829-1 plasma-workspace vulnerability

Fabian Vogt discovered that Plasma Workspace did not properly authenticate local clients connecting to the session manager. A local attacker could possibly use this issue to execute arbitrary code as another user...

USN-8829-1: Plasma Workspace vulnerability

Fabian Vogt discovered that Plasma Workspace did not properly authenticate local clients connecting to the session manager. A local attacker could possibly use this issue to execute arbitrary code as another user...

CVE-2026-82933

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

CVE-2026-52749

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perfor...

CVE-2026-52749 Improper Authentication in Kaon AR2140X

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perfor...

EUVD-2026-88247

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perfor...

CVE-2026-52749

The Kaon AR2140X router is vulnerable to an authentication bypass because it improperly issues session cookies in responses to unauthenticated HTTP requests. This flaw allows a remote attacker to obtain a valid session identifier without credentials. Once authenticated, an attacker can perform un...

CVE-2026-52749 Improper Authentication in Kaon AR2140X

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perfor...

CVE-2026-82933

The mH-DEVELOPER smart home module is vulnerable to cleartext transmission of sensitive information because it sends web interface and API traffic over unencrypted HTTP . This allows an attacker on the same network to intercept passwords , authentication tokens , and device commands , potentially...

CVE-2026-82933 Cleartext Transmission of Sensitive Information in mH-DEVELOPER

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

CVE-2026-82933 Cleartext Transmission of Sensitive Information in mH-DEVELOPER

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

EUVD-2026-88232

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

CVE-2026-100655

A flaw was found in Netty. This vulnerability allows a remote attacker to cause a Denial of Service DoS by exhausting server memory. Because the SPDY session handler does not restrict the number of concurrent streams initiated by a remote peer, an attacker can transmit an excessive volume of stre...

CVE-2026-84652

A flaw was found in Jenkins. When a user authenticates using the "remember me" cookie, Jenkins fails to rotate the session identifier. This oversight allows a remote attacker, who can serve content on the same site as Jenkins, to set a known session cookie in a victim's browser. Consequently, onc...

Exploit for CVE-2026-85984

CVE-2026-85984 — miniOrange OTP Login Auth Bypass Python 3...

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

[SECURITY] Fedora 45 Update: cinnamon-session-6.7.5^unstable-1.fc45

Cinnamon-session manages a Cinnamon desktop or GDM login session. It starts up the other core components and handles logout and saving the session...

PT-2026-102367

Name of the Vulnerable Software and Affected Versions proxygen versions 2026.04.06.00 through 2026.09.28.00 Description A use-after-free issue exists where the QuicWtSession::closeSession function accesses member fields after invoking the base QuicWtSessionBase::closeSession method. Because the...