67025 matches found
ROS-20261002-73-0116
The vulnerability of the PostgreSQL database management system is related to incorrect session duration. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read and modify data...
ROS-20261002-73-0115
The vulnerability of the PostgreSQL database management system is related to incorrect session duration. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read and modify data...
ROS-20261002-73-0112
The vulnerability of the PostgreSQL database management system is related to incorrect session duration. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read and modify data...
tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination
A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...
CVE-2026-51895
Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...
CVE-2026-55394
Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic...
CVE-2026-39987
CVE-2026-39987 - Marimo Pre-Authentication RCE CVE-2026-39987 is a critical pre-authentication Remote Code Execution RCE vulnerability affecting Marimo, a reactive Python notebook environment. The vulnerability exists in Marimo's terminal WebSocket endpoint: /terminal/ws The endpoint failed to...
GO-2026-6589 ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel
ZITADEL: MFA bypass via session reuse in Login V2 in github.com/zitadel/zitadel...
EUVD-2026-91051
Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic...
CVE-2026-14984 Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2
Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic...
CVE-2026-14984 Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2
Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic...
russh: russh: Cryptographic fallback bypass via missing public key validation
A flaw was found in russh. The library fails to validate peer public keys during hybrid cryptographic key exchange, accepting an all-zero key. A remote attacker acting as a malicious Secure Shell SSH peer can exploit this flaw during connection negotiation to force the classical encryption...
CVE-2026-57941
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
AZL-106482 CVE-2026-57941 affecting package httpd for versions less than 2.4.69-1
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
AZL-106074 CVE-2026-57941 affecting package mod_http2 2.0.29-3
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
ALPINE-CVE-2026-57941
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-57941
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
UBUNTU-CVE-2026-57941
Use After Free vulnerability in Apache HTTP Server's modhttp2 via shared session-bbtmp re-entrancy This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68...
CVE-2026-73975 djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying DELETE/INSERT query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in t...
CVE-2026-73975 djehuty: Authenticated SPARQL injection in session editing allows writing arbitrary RDF triples
djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, an authenticated depositor can inject arbitrary SPARQL into a state-modifying DELETE/INSERT query by supplying a crafted session name, letting them write and delete arbitrary triples anywhere in t...