EUVD-2026-53553

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

CVE-2026-7658

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

CVE-2026-39924

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...

CVE-2026-39924 Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...

EUVD-2026-53392

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...

CVE-2026-39924 Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...

CVE-2026-39924: Insufficient Session Expiration

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the accesstokens table is never cleared on password change events. The...

PT-2026-68185

Name of the Vulnerable Software and Affected Versions Flarum versions prior to 1.8.16 Description Improper session invalidation allows attackers with a valid session token to maintain full account access even after a password change. This occurs because the access tokens table is not cleared duri...

PT-2026-68290

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description Improper validation of the username field allows attackers to inject path traversal sequences—a technique used to access files and directories outside the intended folder—and bypass...

CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

CVE-2026-58041

CVE-2026-58041 affects Node.js with the node:sqlite integration. The issue: a stale StatementSyncIterator created via DatabaseSync#createTagStore() can continue executing a cached prepared statement after it has been reset and rebound with new parameters. The underlying cause is that SQLTagStore ...

CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

PT-2026-67887

Name of the Vulnerable Software and Affected Versions Ghost versions 2.2.0 through 6.54.0 Description Ghost Admin fails to invalidate existing sessions during the login process, which could enable session fixation attacks. Session fixation is a method where an attacker provides a valid session...

PT-2026-67574

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description A flaw in the node:sqlite module allows a stale StatementSyncIterator created via the DatabaseSynccreateTagStore function to continue executing a cached prepared...

CVE-2024-40683

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

EUVD-2024-55704

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2024-40683 IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password change

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2024-40683

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...