PT-2026-120790

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0 Description The default outbound session-sharing policy allows the reuse of a pooled TLS session...

PT-2026-120695

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

PT-2026-120698

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

PT-2026-120791

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.11 Apache Traffic Server versions 9.0.0 through 9.2.15 Apache Traffic Server versions 10.0.0 through 10.1.4 Apache Traffic Server version 10.2.0 Description Apache Traffic Server allows the...

PT-2026-120700

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

PT-2026-120765

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

PT-2026-120693

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

Session lock leak on an invalid UI id allows DoS in Vaadin 8

A single request carrying a non-numeric v-uiId parameter leaves a Vaadin Framework 8 session locked for good. Every later request to that session blocks, and repeating the request exhausts the servlet container's thread pool, which takes the application down. No authentication is needed. See...

PT-2026-120699

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

PT-2026-120722

MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts...

PT-2026-120842

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the argument user id can lead to missing authentication. It is possible to launch...

PT-2026-120694

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

PT-2026-120697

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder affected versions not specified Cisco Prime Collaboration Deployment affected versions not specified Cisco Unified Communications Manager Unified CM affected versions not specified Cisco Unified Communications Manager...

Vulnerability related to session mechanism issues in WSO2 Identity Server

Vulnerabilities related to session management exist in WSO2 Identity Server versions from 7.0.0 up to and including 7.0.0.85, as well as in WSO2 Carbon OAuth versions from 7.0.26 up to and including 7.0.26.51. These vulnerabilities arise because existing access tokens issued for sub-organization...

Linux Distros Unpatched Vulnerability : CVE-2026-107226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the...

PT-2026-120208

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against the storage API to append, create, or tr...

CVE-2026-9825

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks...

CVE-2026-93744

IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability ...

CVE-2026-91568

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise RDBMS. While the vulnerability ...

CVE-2026-87356

Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite component: Valid Session. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform...