CVE-2026-80890

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctpunpackcookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...

EUVD-2026-70485

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

CVE-2026-75757

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

EEF-CVE-2026-75757 AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Summary Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ashadmin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant,...

PT-2026-83676

Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies tenant, actor...

CVE-2026-48548 Nagios Core CSRF via cmd.cgi

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently...

EUVD-2026-66598

Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as a currently...

CVE-2026-74752

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then...

Linux Distros Unpatched Vulnerability : CVE-2026-48548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.12 contains a cross-site request forgery vulnerability in cmd.cgi where the CSRF protection mechanism passes validation when the NagFormI...

Linux Distros Unpatched Vulnerability : CVE-2026-74752

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIEECHO restores fixed-size AUTH fields directly from peer-controlled...

EUVD-2026-56820

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtlsserverinputhandler and createnewconnectedudpsocket in src/apps/relay/dtlslistener.c retain OpenSSL dtls1reassemblefragment state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before...

CVE-2026-73214 coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, dtlsserverinputhandler and createnewconnectedudpsocket in src/apps/relay/dtlslistener.c retain OpenSSL dtls1reassemblefragment state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before...

CVE-2026-73214

Coturn (TURN/STUN server) has a vulnerability in pre-4.16.0 where dtls_server_input_handler() and create_new_connected_udp_socket() retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello that declares a 650,000-byte handshake before cookie validation. This allows an...

PT-2026-70829

Name of the Vulnerable Software and Affected Versions Coturn versions prior to 4.16.0 Description The dtls server input handler and create new connected udp socket functions in src/apps/relay/dtls listener.c retain the state of the OpenSSL dtls1 reassemble fragment function when processing a...

CVE-2026-15255

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

EUVD-2026-50999

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

PT-2026-66398

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

CVE-2026-60134 Weintek cMT3092X Reliance on Cookies without Validation and Integrity Checking in a Security Decision

Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges...