UBUNTU-CVE-2026-98707

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory...

CVE-2026-12254: Insufficient Session Expiration

Netskope is notified about a potential gap in its agent NSClient where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via t...

PT-2026-118087

Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools in github.com/0xJacky/Nginx-UI...

PT-2026-117690

Name of the Vulnerable Software and Affected Versions IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 Description The system fails to invalidate the session after a user logs out. This flaw allows an authenticated user to impersonate another user on the system. Recommendations Update...

PT-2026-117487

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Session-bound tokens are not revoked upon user session termination when token binding validation is enabled and the "Revoke token upon user logout" option is...

PT-2026-118086

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module in github.com/dunglas/frankenphp...

PT-2026-117319

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...

PT-2026-117307

MISP contains a reflected cross-site scripting XSS vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encoding. An attacker who can influence the parameter names...

Apache HTTP Server 2.4.63 TLS Upgrade Session Hijacking

Apache HTTP Server version 2.4.63 with modssl configured with SSLEngine optional contains an HTTP desynchronization flaw that allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. https://packetstorm.news/download/236361...

PT-2026-117620

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.98 Parse Server versions 9.0.0 through 9.10.3-alpha.1 Description Insufficient enforcement of class-level permissions for the Session class occurs during session creation. An authenticated user or an entity...

PT-2026-117699

IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session...

PT-2026-118073

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes in github.com/0xJacky/Nginx-UI...

CVE-2026-86589: Incorrect Implementation of Authentication Algorithm

Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass...

CVE-2026-79624: Insufficient Session Expiration

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3,...

ROS-20261018-73-0001

The vulnerability of the createKeyBundle method in the X2Go remote access application is related to the execution of the application with excessive privileges. Exploiting this vulnerability could allow a attacker to establish a full SSH session with the remote server. Information about this...

CVE-2025-13173: Insufficient Session Expiration

Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active...

PT-2026-118033

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

PT-2026-118055

Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2025-36069: Insufficient Session Expiration

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system...

CVE-2025-36252: Insufficient Session Expiration

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system...