Fedora 45 : cinnamon / cinnamon-desktop / cinnamon-session / etc (2026-c4d5a488fe)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-c4d5a488fe advisory. - Update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but...

CVE-2026-94422

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

DEBIAN-CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

AZL-105185 CVE-2026-94419 affecting package mariadb 10.11.19-1

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

UBUNTU-CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419 Client session cache reference poisoning allows resumption with wrong server

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419 Client session cache reference poisoning allows resumption with wrong server

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

EUVD-2026-87906

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-100862

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100725

http4k Maven artifact org.http4k:http4k-core before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage client-side cookie store used by ClientFilters.Cookies that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage...

EUVD-2026-87827

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100862

The workflow automation platform heym versions prior to 0.0.91 contains multiple plaintext storage vulnerabilities. The application fails to encrypt several sensitive secrets, including webhook header-auth values , MCP API keys , portal session tokens , workflow execution JWTs , and Discord inter...

CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100725 http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

http4k Maven artifact org.http4k:http4k-core before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage client-side cookie store used by ClientFilters.Cookies that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage...