CVE-2026-55149 Vouch Proxy: Unbounded Multipart Cookie Allocation DoS

Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the authrequest module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to makestring, numParts without checking that the value is...

DEBIAN-CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

UBUNTU-CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-91991

Tornado (Python web framework) versions before 6.5.8 contain an incomplete fix for cookie attribute injection in the set_cookie function. An attacker can pass capitalized or legacy keyword arguments (e.g., Domain, Path, SameSite) to embed semicolon-delimited data, bypassing validation and modifyi...

CVE-2026-91991 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

EUVD-2026-78663

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-91991 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-91991 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-55617

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-55617 Hydro: Insufficient session expiration when recreating sessions

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-55617

Hydro (the hydrooj NPM package), a high-performance online judge platform, contains an insufficient session expiration vulnerability in its session recreation logic (packages/hydrooj/src/service/layers/base.ts). From 4.10.4 through 5.0.1 , a new session token is created without deleting the previ...

EUVD-2026-78768

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-55617 Hydro: Insufficient session expiration when recreating sessions

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

CVE-2026-55617 Hydro: Insufficient session expiration when recreating sessions

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

USN-8762-1 policykit-1 vulnerability

It was discovered that polkit incorrectly handled cookie input. A local attacker could possibly use this issue to cause polkit to crash, resulting in a denial of service, or execute arbitrary code...

USN-8762-1: polkit vulnerability

It was discovered that polkit incorrectly handled cookie input. A local attacker could possibly use this issue to cause polkit to crash, resulting in a denial of service, or execute arbitrary code...

CVE-2026-52827 Kimai: Two-factor authentication bypass on the Kimai API

Kimai is an open-source time tracking application. Prior to 2.59.0, the KIMAISESSION cookie issued after password verification but before TOTP completion is accepted by every /api route because config/packages/security.yaml protects the API with ISAUTHENTICATED and...