PT-2026-86162

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User Model::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...

CVE-2026-84933: Exposure of Sensitive Information to an Unauthorized Actor

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

PT-2026-86152

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The cache interceptor fails to handle the Set-Cookie response header, allowing it to be stored and re-served in shared cache mode. This occurs when a cacheab...

CVE-2026-84933: Exposure of Sensitive Information to an Unauthorized Actor

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-82186: Improper Neutralization of Special Elements used in an SQL Command

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

PT-2026-85420

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks...

PT-2026-86181

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Stream Control Transmission Protocol SCTP implementation where the sctp unpack cookie function fails to perform cookie expiration checks if an association already...

PT-2026-91798

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp unpack cookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...

PT-2026-85665

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

EUVD-2022-56032

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...

CVE-2026-75171

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component...

PT-2026-85700

Name of the Vulnerable Software and Affected Versions HubCore version 14.1.1 Description An issue in the HUBCOREID session cookie handling component allows a remote attacker to escalate privileges. Recommendations At the moment, there is no information about a newer version that contains a fix fo...

CVE-2026-75171

A vulnerability exists in HubCore v.14.1.1 involving the HUBCOREID session cookie handling component. This flaw allows a remote attacker to achieve privilege escalation . While the vulnerability is documented across multiple sources, specific exploit details and remediation steps are not provided...

CVE-2026-75171

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component...

CVE-2026-53756: Improper Neutralization of Special Elements used in an SQL Command

Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in UserModel::getUserDataByLogin. The $account parameter is directly interpolated into SQL queries without any filtering. The vulnerability is reachable through the auth cookie...

PT-2026-93249

Name of the Vulnerable Software and Affected Versions polkit affected versions not specified Description An issue exists where cookie input is handled incorrectly, specifically involving a stack buffer underflow in the read cookie function. This was introduced as a regression in a previous fix. A...

EUVD-2026-71442

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component...

Linux Distros Unpatched Vulnerability : CVE-2026-80890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: reject stale cookies with mismatched verification tags sctpunpackcookie skips cookie expiration checks whenever an association already exists. This is...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cockpit (UTSA-2026-106156)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106156 advisory. A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowi...

CVE-2022-35497: Improper Neutralization of Input During Web Page Generation

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external document viewer endpoint...