CVE-2026-81181

SysReptor , a customizable pentest reporting platform, is vulnerable to session fixation in the password authentication flow for protected shared notes. Prior to version 2026.68 , the session identifier is not rotated after successful authentication. An attacker who places an unauthenticated sess...

CVE-2026-81181 SysReptor: Session Fixation in Password-Protected Shared Notes

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2025-13882 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow an unauthenticated user to cause a denial of service in the email service due to improper control...

CVE-2026-81181: Session Fixation

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor...

PT-2026-95581

Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.68 Description The password authentication flow for protected shared notes fails to rotate the session identifier after successful authentication, leading to session fixation. This occurs when an attacker obtai...

CVE-2026-86688

Session Fixation vulnerability in team-alembic ashauthentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.storeinsession/2 writes the authenticated subject into the existi...

CVE-2026-86688

CVE-2026-86688 is a session fixation vulnerability in ash_authentication , an Elixir authentication library by team-alembic. The root cause is that AshAuthentication.Plug.Helpers.store_in_session/2 writes the authenticated subject into the existing session via Plug.Conn.put_session/3 without ever...

EUVD-2026-82579

Session Fixation vulnerability in team-alembic ashauthentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.storeinsession/2 writes the authenticated subject into the existi...

EEF-CVE-2026-86688 Session id is not renewed on authentication in ash_authentication, allowing session fixation

Summary Session Fixation vulnerability in team-alembic ashauthentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.storeinsession/2 writes the authenticated subject into th...

CVE-2026-86688 Session id is not renewed on authentication in ash_authentication, allowing session fixation

Session Fixation vulnerability in team-alembic ashauthentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.storeinsession/2 writes the authenticated subject into the existi...

CVE-2026-86688 Session id is not renewed on authentication in ash_authentication, allowing session fixation

Session Fixation vulnerability in team-alembic ashauthentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.storeinsession/2 writes the authenticated subject into the existi...

CVE-2026-86688 Session id is not renewed on authentication in ash_authentication, allowing session fixation

Session Fixation vulnerability in team-alembic ashauthentication allows an attacker who can plant a session identifier in a victim's browser to hold an authenticated session once that victim signs in. AshAuthentication.Plug.Helpers.storeinsession/2 writes the authenticated subject into the existi...

Security Bulletin: spring-web-6.2.18.jar (Publicly disclosed vulnerability found by Scanner)

Summary Multiple Spring Framework spring-web vulnerabilities affecting 6.2.0–6.2.18: session fixation via compromised subdomain CVE-2026-41839, WebFlux multipart DoS CVE-2026-41840, XSS via incorrect JavaScriptUtils.javaScriptEscape escaping CVE-2026-41845, multipart request smuggling in Spring...

org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve

A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will...

Session Fixation

Overview org.opencastproject:base is a free and open source solution for automated video capture and distribution at scale. Affected versions of this package are vulnerable to Session Fixation via URL-based jsessionid handling in the Spring Security HTTP configuration in...

CVE-2026-92984

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the...

CVE-2026-77614

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mhdefaultorg.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does no...

org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve

A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will...

org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve

A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will...

org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve

A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will...