CVE-2026-79537

metatool-ai MetaMCP versions through 2.4.22 are vulnerable to an Insecure Direct Object Reference (IDOR) in the MCP transport session dispatch. The root cause is that the session store (getSession in session-lifetime-manager.ts) is keyed solely by the client-supplied mcp-session-id header without...

CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

CVE-2026-79537

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

EUVD-2026-89362

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference IDOR in the MCP transport session dispatch. The session store getSession in session-lifetime-manager.ts is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the...

PT-2026-102635

Name of the Vulnerable Software and Affected Versions @socket.io/cluster-engine versions prior to 0.1.1 Description In clustered deployments, the software uses inherited object properties when looking up session IDs controlled by an attacker. By using special property names like proto or...

PT-2026-99306

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description An authentication bypass exists in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid...

CVE-2026-100635: Cleartext Transmission of Sensitive Information

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange...

CVE-2026-92983 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

CVE-2026-92983

InternLM LMDeploy through 0.17.0 is affected by a memory exhaustion vulnerability in its DistServe prefill/decode disaggregation mode . The root cause is that the proxy uses user-facing session IDs instead of internal scheduler keys, causing scheduler sessions to never be released. An unauthentic...

CVE-2026-92983 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

CVE-2026-92983 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

PT-2026-93822

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description The SSE client-to-server POST endpoints are marked as @csrf exempt and the SSE GET stream endpoint lacks an Origin check. This allows a cross-origin page to manipulate a session authenticated by victim...

CVE-2026-39039

The BharatMLStack software (up to and including v1.3.0 ) contains a vulnerability in the Trufflebox UI where it stores sensitive information in the browser's localStorage . Specifically, the JWT authentication token , full user object , and session ID are stored in a manner that makes them fully ...

CVE-2026-39039: Improper Neutralization of Input During Web Page Generation

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

Fedora 43 : perl-Dancer2 (2026-d0bededb87)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d0bededb87 advisory. Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there...

Astra Linux – Vulnerability in Tomcat9

There is a vulnerability related to insufficient session expiration in Apache Tomcat. This vulnerability means that if the session ID of an authenticated HTTP session is changed after a WebSocket connection is established under that authenticated HTTP session, the WebSocket session will not be...

Fedora 44 : perl-Dancer2 (2026-d13a2593b1)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d13a2593b1 advisory. Dancer2 gnrates sessions id from low-entropy sources if Crypt::URandom and Math::Random::ISAAC::XS are not present. With this update, they are always there...

CVE-2026-64857

tirreno , a security framework, is affected by a session fixation vulnerability in versions prior to 0.10.0 . During login, tirreno validates credentials and establishes the authenticated session but fails to call session_regenerate_id(), leaving the session identifier unchanged before and after ...

EUVD-2026-74954

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...