CVE-2026-1758

Session fixation vulnerability in Secomea GateManager webserver module allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above...

CVE-2026-1758 Session Fixation

Session fixation vulnerability in Secomea GateManager webserver module allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above...

CVE-2026-1758 Session Fixation

Session fixation vulnerability in Secomea GateManager webserver module allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above...

EUVD-2026-78410

Session fixation vulnerability in Secomea GateManager webserver module allows Session Fixation. This issue affects GateManager: 11.5;0, 11.4.625515072:0. Fixed in Version 11.6 or 11.4.626194074 and above...

CVE-2026-1758

CVE-2026-1758 is a session fixation vulnerability in the webserver module of Secomea GateManager , a security access control management platform. The flaw affects GateManager versions 11.5;0 and 11.4.625515072:0 , and is remediated in version 11.6 or 11.4.626194074 and above . The CVSS v3.1 score...

CVE-2026-46623

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts...

CLSA-2026-1789466898 Fix of 7 CVEs

SECURITY UPDATE: symlink attack on the daemon module-root chdir - debian/patches/els/0031-CVE-2026-53784.patch: add safeopennoattackersymlinks in util.c and confine the daemon module-root chdir under use-chroot=no. els/0006 had hardened only the relative branch of changedir; the absolute branch w...

CVE-2026-46623 OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts...

CVE-2026-46623 OpenAM Account Takeover via Unverified Password Change in OAuth2 Module

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth2 authentication module updates an existing local account with profile attributes that can include userPassword and inetUserStatus, rewriting the password to the username and reactivating disabled accounts...

CVE-2026-46619 OpenAM Authentication Bypass via MSISDN LDAP Injection

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, MSISDNValidation in the MSISDN authentication module concatenates the request-supplied MSISDN value into an LDAP search filter without escaping, while the default empty trusted-gateway list allows all traffic. In a...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server...

CLSA-2026-1789462227 rsync: Fix of 4 CVEs

CVE-2026-53784: resolve the daemon module-root chdir through a trusted-owner walk so a planted symlink on the module path or any parent component cannot steer the daemon outside the module under "use chroot = no" - CVE-2026-53795: confine each side of dorenameat/dolinkat independently; an...

DEBIAN-CVE-2026-90711

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

CVE-2026-89141

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-90879

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

CVE-2026-90879 zyx0814 FilePress Publish search.php sql injection

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

EUVD-2026-78269

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

CVE-2026-90879 zyx0814 FilePress Publish search.php sql injection

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

CVE-2026-90879 zyx0814 FilePress Publish search.php sql injection

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

CVE-2026-90879

zyx0814 FilePress (versions up to 3.0.1 ) is vulnerable to SQL injection in the Publish Module file dzz/publish/search.php, caused by unsanitized manipulation of the orderby/order argument. The vulnerability is exploitable remotely without authentication. A public proof-of-concept exploit is avai...