PYSEC-2026-3481 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

Summary In affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enabletasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...

PYSEC-2026-3510 PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing

PraisonAI LinearBot processes unsigned webhooks when LINEARWEBHOOKSECRET is missing Summary PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEARWEBHOOKSECRET as optional. When the secret is absent, startup only logs a warning and handlewebhook skips Linear-Signature...

EUVD-2026-48239

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session...

CVE-2026-64813

JetBrains IntelliJ IDEA prior to version 2026.2 contains a vulnerability where unauthorized settings modification is possible during Remote Development sessions. The issue is indicated as a CRITICAL impact (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with network attack vector, no privileges r...

EUVD-2026-48237

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

CVE-2026-64812

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...

CVE-2026-64813

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session...

EUVD-2026-48238

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Media Session component in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 — cPanel & WHM Authentication Bypass CVSS v3...

PT-2026-64162

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.5 MOVEit Transfer versions 2026.0.0 through 2026.0.2 Description Progress MOVEit Transfer contains an issue where sessions do not expire sufficiently, which could allow unauthorized access to active...

Oracle Linux 8 : httpd:2.4 (ELSA-2026-42828)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42828 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 -...

VulnCheck KEV: CVE-2026-8496

A cross-site scripting XSS vulnerability exists in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS...

PT-2026-63967

Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2 Description An issue exists in Remote Development sessions that allows for the unauthorized modification of settings. Recommendations Update JetBrains IntelliJ IDEA to version 2026.2...

VulnCheck KEV: CVE-2025-62631

An insufficient session expiration vulnerability CWE-613 vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to maintain access to network resources via an active SSLVPN session not terminated after a user's passwor...

PT-2026-71920

Name of the Vulnerable Software and Affected Versions next-auth versions 5.0.0-beta.0 through 5.0.0-beta.31 Description Applications using the auth wrapper to gate access by checking only for the existence of the returned object can fail open during server configuration errors. In middleware, Rou...

Exposure of Data Element to Wrong Session

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session due to the connection-scoped trailers handling in the HTTP/1.1 request processing path. ...

CVE-2026-64829

Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers with a previously obtained remember-me cookie to retain authenticated access by exploiting the forgot-password reset flow's failure to clear the sessioncode field in qa-include/app/users-edit.php...

CVE-2026-13061

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...

UBUNTU-CVE-2026-13061

An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stage. This information is normally restricted to users with cluster-level administrative privileges, and includes active session identifiers, associated...