CVE-2018-13379

🛡️ CVE-2018-13379 - Fortinet SSL VPN 脆弱性 🔍 概要 CVE-2018-13379 は Fortinet FortiOS SSL VPN における 重大なパストラバーサル 脆弱性です。 攻撃者が VPN ウェブセッションファイルをダウンロード し、機密情報を抽出することを可能にします。 影響: 情報漏洩（ユーザー名、セッショントークン） CVSSv3: 8.6（高） 悪用条件: リモート、認証不要 💻 影響を受けるバージョン FortiOS 5.4.6 – 5.4.12 FortiOS 5.6.3 – 5.6.7 FortiOS 6.0.0 –...

CVE-2026-66372

The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space...

CVE-2026-66372: Predictable Seed in Pseudo-Random Number Generator (PRNG)

The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space...

CVE-2026-86755: Incorrect Authorization

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

SUSE-SU-2026:3460-1 Security update for python-urwid

This update for python-urwid fixes the following issue: - CVE-2026-9323: web session IDs generated by Screen.start are not cryptographically secure bsc1271868...

SUSE SLED15 / SLES15 Security Update : python-urwid (SUSE-SU-2026:3425-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3425-1 advisory. This update for python-urwid fixes the following issue CVE-2026-9323: web session IDs generated by Screen.start are not...

Security update for python-urwid

This update for python-urwid fixes the following issue CVE-2026-9323: web session IDs generated by Screen.start are not cryptographically secure bsc1271868. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:3425-1 Security update for python-urwid

This update for python-urwid fixes the following issue CVE-2026-9323: web session IDs generated by Screen.start are not cryptographically secure bsc1271868...

CVE-2026-9323

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

CVE-2026-0281

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker. The...

EUVD-2026-42680

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker. The...

CVE-2026-0281

CVE-2026-0281 describes an information-disclosure vulnerability in Palo Alto Networks PAN-OS. An unauthenticated attacker with network access to the management web interface can obtain web session tokens, but exploitation requires a legitimate user to click a malicious link. Affected products inc...

PT-2026-56910

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker. The...

CVE-2026-0281: Use of Cache Containing Sensitive Information

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker. The...

CVE-2026-48492: Missing Authorization

Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/object/selectlist API endpoint is missing an authorization check. Any user who can log into Snipe-IT - regardless of permissions - can retrieve a paginated list of all user accounts using only their web...

PT-2026-55303

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7 Description Predictable session identifiers can lead to session hijacking. The issue occurs because HTTP session identifiers in the src/HTTPserver.cpp file use weak time-seeded pseudo-randomness during session...

CVE-2026-56208 Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing LAP mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when glaginframes is set to 1 or higher. This results in a 232-byte...

CVE-2026-44693 Pi-hole FTL: Unauthenticated Session Hijacking via Race Condition on Global Session Buffer

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This iss...

EUVD-2026-36194

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This iss...

FTL 竞争条件问题漏洞

FTL is an open-source network advertising interception and statistics tool developed by Pi-hole. Versions of FTL prior to 6.6.1 contained a race condition vulnerability, which stems from race conditions in the HTTP session management subsystem. This vulnerability could allow attackers to perform...