CVE-2026-79624 Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...

EUVD-2026-104162

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...

CVE-2026-79624

The software Apache Answer is vulnerable to an insufficient session expiration issue in versions through 2.0.2 . Due to insufficient session invalidation, revoked users can maintain access to known private uploaded files by using a stale visit token . To remediate this vulnerability, users are re...

CVE-2026-79624

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...

UBUNTU-CVE-2026-98707

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory...

CVE-2026-12254: Insufficient Session Expiration

Netskope is notified about a potential gap in its agent NSClient where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via t...

PT-2026-118087

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools in github.com/0xJacky/Nginx-UI...

PT-2026-117690

Name of the Vulnerable Software and Affected Versions IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 Description The system fails to invalidate the session after a user logs out. This flaw allows an authenticated user to impersonate another user on the system. Recommendations Update...

PT-2026-117487

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Session-bound tokens are not revoked upon user session termination when token binding validation is enabled and the "Revoke token upon user logout" option is...

PT-2026-118086

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module in github.com/dunglas/frankenphp...

PT-2026-117319

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...

PT-2026-117307

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

Apache HTTP Server 2.4.63 TLS Upgrade Session Hijacking

Apache HTTP Server version 2.4.63 with modssl configured with SSLEngine optional contains an HTTP desynchronization flaw that allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. https://packetstorm.news/download/236361...

PT-2026-117620

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.98 Parse Server versions 9.0.0 through 9.10.3-alpha.1 Description Insufficient enforcement of class-level permissions for the Session class occurs during session creation. An authenticated user or an entity...

PT-2026-117699

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session...

PT-2026-118073

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI...

CVE-2026-79624: Insufficient Session Expiration

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...

ROS-20261018-73-0001

The vulnerability of the createKeyBundle method in the X2Go remote access application is related to the execution of the application with excessive privileges. Exploiting this vulnerability could allow a attacker to establish a full SSH session with the remote server. Information about this...

CVE-2025-13173: Insufficient Session Expiration

Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active...

PT-2026-118033

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...