EUVD-2026-81481

Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign that victim into an attacker-controlled account. AshAuthentication.Strategy.OAuth2.Plug.callback/2 clears the stored...

SSHPry2.0

SSHPry2.0 这是SSHPry工具的第二个版本，增加了多项功能。 控制目标的TTY 内置键盘记录器 控制台级钓鱼 记录并回放之前的会话 Demo: https://youtu.be/2gfnBvu1u34 Blogpost: http://www.korznikov.com/2017/09/sshpry-v2-spy-control-ssh-connected.html Twitter: @nopernik 使用方法 ./sshpry2.py 文件： sshpry2.py - 工具本身 其他所有代码片段均被工具使用（不依赖于它们）...

agensic

Sepa qué se ejecutó, dónde, cuándo y quién lo ejecutó La capa de observabilidad faltante para flujos de trabajo de terminal impulsados por IA Signed Provenance Tracked Sessions Git Time Travel Replayable Sessions IDE style Tab Autocomplete Agensic actualiza tu flujo de trabajo terminal existente...

JumpServer > 3.6.4 - Information Disclosure

JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. Session replays stored in S3, OSS, or other cloud storage are not...

CVE-2026-41940-Exploit-PoC

POC del Exploit CVE-2026-41940 1. Ejecuta el script del exploit y especifica el objetivo root@kitploit: python3 exploit.py --target https://example.com:2087/ 2. Captura la sesión y reprodúcela en Burp Suite Copia el valor de whostmgrsession generado por el script Abre la URL objetivo en el...

CVE-2026-55617

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-79696

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

EUVD-2026-74768

A Code Injection vulnerability in adk web in Google Cloud Agent Development Kit ADK for Python versions 2.0.0 through 2.6.0 on Python OSS, Cloud Run, and GKE environments where pytest is installed allows an unauthenticated remote attacker to execute arbitrary code using a crafted test session...

CVE-2026-79696

Google Cloud Agent Development Kit (ADK) for Python (versions 2.0.0 through 2.6.0) contains a code injection vulnerability in the adk web component caused by an incomplete standard library denylist . In environments where pytest is installed—on Python (OSS), Cloud Run, and GKE—an unauthenticated ...

PT-2026-88902

CVE-2026-79696: A Perfect 10.0 in Google's Agent Toolkit Google just shipped a fix for a vulnerability that scored a perfect 10.0 on the CVSS scale — the maximum severity a flaw can get. The bug lives in ADK, Google Cloud's Agent Development Kit for Python — the framework a growing number of team...

CVE-2026-75034 Rancher: SAML Assertion Replay

A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a...

Malicious code in amplitude-session-replay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb71ca2dc9e74e42a64b1533ecb98ea1cad26e283b0c3d3ba0f4e7c760fac713 package.json declares a dependency whose key is the package's own name amplitude-session-replay and whose value is a plain HTTPS URL,...

CVE-2025-61479

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SPC Connect Pro software accepts replayed application-layer payloads injected into an active TCP session...

CVE-2025-61479

Vanderbilt Industries Acre Security SPC5300.000 Main Board version 3.14.1 is affected by a denial-of-service vulnerability. The root cause is that SPC Connect Pro software accepts replayed application-layer payloads injected into an active TCP session, allowing a physically proximate attacker to ...

CVE-2026-19349 Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends

Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormIn...

OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning

A newly disclosed flaw in the way OpenAI, Anthropic, and Google carried hidden AI reasoning between API calls let researchers recover internal reasoning and secrets from session logs, including API keys and passwords. The weakness affected encrypted reasoning objects used by the providers'...

CVE-2026-72780

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...

CVE-2026-66883

Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.Authorize module renders the user agent session binding inert, removing a defense in depth control against replay of a stolen session. This vulnerability is associated with program files...

CVE-2026-14465 Session Fixation in Bilin Software's HUMANIST Digital Human Resources

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14465

Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...