PT-2026-113991

Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2...

PT-2026-113768

An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability...

Linux Distros Unpatched Vulnerability : CVE-2026-107612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process...

CVE-2026-55682: Exposure of Sensitive Information to an Unauthorized Actor

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DBHOST as the cookie domain. If a victim authenticates while using the attacker-selected...

CVE-2026-57493: Insufficient Session Expiration

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...

CVE-2026-57489: Authentication Bypass by Spoofing

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...

CVE-2026-107421: Session Fixation

Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2...

CVE-2026-107594: External Control of File Name or Path

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the...

CVE-2026-84471: Use After Free

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

CVE-2026-94260: Missing Authorization

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting...

CVE-2026-89073: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-101938: Integer Underflow (Wrap or Wraparound)

An Integer Underflow Wrap or Wraparound vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session...

PT-2026-114411

A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create req of the file python/sglang/srt/session/session controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be...

CVE-2026-102082: Improper Handling of Missing Special Element

An Improper Handling of Missing Special Element vulnerability in the SSL plugin of Juniper Networks Junos OS on SRX Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service DoS. This issue is will occur when 'ssl-proxy' is configured on SRX platforms and during a TLS...

PT-2026-114141

Name of the Vulnerable Software and Affected Versions sgl-project SGLang versions prior to 0.5.20 Description A remote denial of service can be triggered through the manipulation of the session params argument within the generate endpoint, specifically affecting the functionality in the file...

PT-2026-113969

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.23.0 Description FileRise fails to record when a Time-based One-Time Password TOTP code has already been successfully used for a specific account and time step. An attacker possessing valid primary credentials and ...

PT-2026-113981

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 18.0 through 27.3.4.18 Erlang/OTP versions 28.0 through 28.5.0.7 Erlang/OTP versions 29.0 through 29.1.1 ssl versions 7.0 through 11.2.12.13 ssl versions 11.6.0 through 11.6.0.6 ssl versions 11.7.0 through 11.7.7 Descriptio...

CVE-2026-109527: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

nginx -- multiple vulnerabilities

The nginx developers report: A buffer overflow might occur in a worker process when using the "alias" directive if the request URI was changed by the "rewrite" directive and was then mapped to a file path CVE-2026-15176. A buffer overflow might occur in a worker process while evaluating string...

PT-2026-113793

An Integer Underflow Wrap or Wraparound vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an adjacent unauthenticated attacker to cause a forwarding-plane denial of service via an ICMP message associated with an SVR carrier session...