PT-2026-63465

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user can access session metadata of other users via the $listSessions aggregation stage. This data, which includes active session identifiers,...

PT-2026-63355

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

Plone Products.PlonePAS < 3.2.2 / 3.3.x < 3.9 Insecure Session Management

The version of Products.PlonePAS installed on the remote host is prior to 3.2.2 or 3.3.x prior to 3.9. It is, therefore, affected by an insecure session management vulnerability due to not properly handling the login form. An authenticated, remote attacker can exploit this to acquire the identity...

CVE-2026-47039

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise Ja...

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

The vulnerability is in the Remember-Me giteaincredible token validation logic, specifically when handling a compromised token hash mismatch. The vulnerable function is this one: https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/services/auth/authtoken.goL33-L64...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the CheckAuthToken function. An attacker can maintain unauthorized, persistent access to a user's account by reusing a stolen Remember-Me token, as the compromised session is not invalidated even after...

CVE-2026-56583

HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...

CVE-2026-56581

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

EUVD-2026-46346

HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...

CVE-2026-56583

Technical details are not publicly available in the provided documents. Monitor for updates from HCL and NVD to obtain affected versions, root cause, and remediation guidance.

CVE-2026-56583 HCL MyCloud was affected with Concurrent Login Vulnerability.

HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...

CVE-2026-56581 HCL MyCloud was affected with Cookie Attribute Path Not Set

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

EUVD-2026-46344

HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens...

CVE-2026-56581

CVE-2026-56581 affects HCL MyCloud with a Cookie Attribute Path Not Set issue. The vulnerability is described as enabling potential unauthorized access to session data or authentication tokens due to cookies not setting the Path attribute, increasing exposure. The available sources (NVD/CVELIST) ...

CVE-2026-46715

A flaw was found in Flask-Security-Too. The OAuth reauthentication process in the affected component can incorrectly mark a user's session as recently reauthenticated after an attacker verifies their own OAuth account within an already authenticated but stale victim session. This allows an attack...

CVE-2026-64823

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...

CVE-2026-28315

SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account...

EUVD-2026-46295

SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account...

CVE-2026-64823

CVE-2026-64823 affects Home Assistant Core prior to 2026.5.4 via the Shelly integration’s async_get_media_image(), where a data: URI with text/html can bypass the image-only allowlist. The vulnerability enables an attacker controlling a Shelly device’s thumb field to cause the media proxy endpoin...

EUVD-2026-46267

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex accepts arbitrary strings as submission indexes without numeric validation, and adminformelement...