CVE-2026-73292 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

EUVD-2026-57311

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

CVE-2026-68756

A party with write access to stored session data may affect JFrog Artifactory under specific conditions...

CVE-2026-66376

Credentials for a deleted user may remain valid for a short period under specific conditions...

CVE-2026-47234

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

EUVD-2026-57252

A party with write access to stored session data may affect JFrog Artifactory under specific conditions...

CVE-2026-68756 Potential insecure deserialization in JFrog Artifactory

A party with write access to stored session data may affect JFrog Artifactory under specific conditions...

CVE-2026-68756

CVE-2026-68756 concerns a potential insecure deserialization in JFrog Artifactory. The CVE records indicate that a party with write access to stored session data may affect Artifactory under specific conditions. Connected sources (CVELIST) label the issue as potential insecure deserialization; no...

CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

EUVD-2026-57215

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

CVE-2026-47234

CVE-2026-47234 affects Admidio before 5.0.10. When debug logging is enabled, Admidio logs raw cookie values and the active session ID via Session::setCookie() and Session::start(), exposing live session tokens (including auto-login cookies) in application logs. This creates a local/credential-sto...

CVE-2026-47234

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

CVE-2026-47234 Admidio writes session IDs and auto-login cookie values to application logs

Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent...

CVE-2026-47232 Admidio PKCS#12 private key export action lacks CSRF protection

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...

EUVD-2026-57209

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...

CVE-2026-57858

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

CVE-2026-57858

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

CVE-2026-57858 Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

EUVD-2026-57195

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

Security update for openvpn

This update for openvpn fixes the following issues: CVE-2026-11771: NTLM proxy auth stack off-by-one write bsc1273126. CVE-2026-12932: memory leak using --tls-crypt-v2 bsc1273127. CVE-2026-12996: potential DoS and memory leak via TLS session use-after-free bsc1273128. CVE-2026-13117: heap...