CVE-2026-68756

CVE-2026-68756 concerns a potential insecure deserialization in JFrog Artifactory. The CVE records indicate that a party with write access to stored session data may affect Artifactory under specific conditions. Connected sources (CVELIST) label the issue as potential insecure deserialization; no...

PT-2026-71111

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description An insecure deserialization issue exists where a party with write access to stored session data may affect the system under specific conditions. Insecure deserialization occurs when...

PT-2026-70043

Name of the Vulnerable Software and Affected Versions SAPUI5 affected versions not specified Description SAPUI5 contains a Cross Site Scripting XSS flaw where a key user with content adaptation privileges can inject malicious script content into persisted application changes. This script executes...

CVE-2026-18531

IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret...

MAL-2026-12108 Malicious code in alipclutch-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd86aa923d73259d0c009ef73d82ca0ddf54e3bf938c23f67291c2f5e4753ed This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses String.fromCharCode... with a...

Malicious code in alipclutch-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd86aa923d73259d0c009ef73d82ca0ddf54e3bf938c23f67291c2f5e4753ed This package is a fork of the Baileys WhatsApp library. In lib/Socket/messages-send.js at lines 425 and 436, code uses String.fromCharCode... with a...

DEBIAN-CVE-2026-69245

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

CVE-2026-56581

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

CVE-2026-56581

CVE-2026-56581 affects HCL MyCloud with a Cookie Attribute Path Not Set issue. The vulnerability is described as enabling potential unauthorized access to session data or authentication tokens due to cookies not setting the Path attribute, increasing exposure. The available sources (NVD/CVELIST) ...

CVE-2026-56581 HCL MyCloud was affected with Cookie Attribute Path Not Set

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

EUVD-2026-46344

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

SAP NetWeaver AS Java XSS in Configuration Wizard (3748227)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3748227: - SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafte...

SUSE CVE-2026-62644

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover...

CVE-2026-62644

A flaw was found in the password plugin of Roundcube Webmail. A remote attacker with low privileges could exploit a username spoofing vulnerability by manipulating session data. This could lead to an account takeover, allowing the attacker to gain unauthorized access to a user's webmail account...

CVE-2026-62644

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover...

DEBIAN-CVE-2026-62644

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover...

UBUNTU-CVE-2026-62644

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover...

CVE-2026-62644

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover...

CVE-2026-62644

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover...

CVE-2026-62644

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover...