Astra Linux – Vulnerability in Firefox, Thunderbird

When the number of cookies per domain was exceeded in document.cookie, the actual cookie jar sent to the host was no longer consistent with the expected state of the cookie jar. This could result in requests being sent with some cookies missing. This vulnerability affects Firefox 116, Firefox ESR...

Astra Linux – Vulnerability in Ceph

A flaw was discovered in Red Hat Ceph Storage 4, within the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for documentation purposes, which again exposes them to...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data through a crafted HTML page...

Astra Linux – Vulnerability in PHP 7.3, PHP 8.1

Due to an incomplete fix for CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p, network and same-site attackers can set an insecure cookie in the victim’s browser. This cookie is treated as a Host- or Secure-cookie by PHP applications...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server versions 2.4.0 to 2.4.46: A specially crafted Cookie header handled by modsession can lead to a NULL pointer derefrence error and system crash, potentially causing a Denial Of Service attack...

CVE-2026-90708

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

EUVD-2026-77384

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-90708 Yot CMS Cookie global.php login sql injection

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-90708

Yot CMS versions up to 3.3.1 contain a SQL injection vulnerability in the Login function within the Cookie Handler component (file: global.php ). An attacker can manipulate the yot3_user and yot3_pass arguments to inject SQL, enabling remote exploitation without authentication or user interaction...

CVE-2026-90708 Yot CMS Cookie global.php login sql injection

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-90708: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-7884: Improper Neutralization of Input During Web Page Generation

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the...

PT-2026-91732

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics versions 12.1.0 through 12.1.3 FP1 IBM Cognos Analytics versions 12.0.4 through 12.0.4 FP2 Description A non-privileged user can inject malicious JavaScript code by editing their given name and surname. The code executes...

Important: mod_auth_openidc

Issue Overview: modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser...

Important: mod_auth_openidc

Issue Overview: modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser...

PT-2026-91170

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3 user/yot3 pass causes sql injection. It is possible to initiate the attack remotely. The explo...

Amazon Linux 2 : mod_auth_openidc (ALAS-2026-3920)

The version of modauthopenidc installed on the remote host is prior to 1.8.8-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3920 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements...

Amazon Linux 2023 : mod_auth_openidc (ALAS2023-2026-2155)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2155 advisory. modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an...

EUVD-2026-76742

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

CVE-2026-78175: Deserialization of Untrusted Data

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...