CVE-2026-14996

IBM Aspera Faspex 5.0.0–5.0.15.4 contains a session-management vulnerability (CVE-2026-14996) with high impact on confidentiality and potential for unauthorized access. The issue affects Faspex 5 deployments prior to 5.0.16 and is addressed by upgrading to IBM Aspera Faspex 5.0.16. This bulletin ...

EUVD-2026-50028

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management...

CVE-2026-14996 Multiple vulnerabilities in IBM Aspera Faspex

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management...

CVE-2026-47725

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...

CVE-2026-48058

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

CVE-2026-48058

Summary of CVE-2026-48058 (nebula-mesh) nebula-mesh (Slack Nebula mesh control plane) versions prior to 0.3.2 expose a cookie security flaw: internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on cookies but omit the Secure attribute. A plaintext HTTP request to the ori...

CVE-2026-48058 nebula-mesh: Session and OIDC state cookies lack the Secure attribute

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc.go set HttpOnly and SameSite=Lax on every cookie but never Secure. A single plaintext request to the origin operator on a LAN, mistyped...

CVE-2026-66745

Artica Proxy 4.50 (before SP7) is affected by a session-fixation flaw that allows an unauthenticated attacker to hijack an admin session by pre-setting a known PHPSESSID on a victim’s browser prior to login through fw.login.php, gaining a fully authenticated admin session on port 9000. Affected v...

EUVD-2026-49955

Artica Proxy before 4.50.000000 Service Pack 7 fixed in hotfix 20260724-02 contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controll...

CVE-2026-16496

The CVE concerns terraform-mcp-server prior to version 1.1.0, where an authorization bypass in the streamable-HTTP stateful transport mode could allow a user who obtains another user’s MCP session ID to execute tool calls using that user’s Terraform credentials. Affected component: terraform-mcp-...

EUVD-2026-49940

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...

CVE-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...

EUVD-2026-49939

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...

CVE-2026-47725 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

Impact A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet and STUN attribute bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception in...

CVE-2026-66753

tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return 0x0D and line feed 0x0A bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can explo...

CVE-2026-43910

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

CVE-2026-66746

Rouille 0.4.0–3.6.2 contains an HTTP response splitting vulnerability. An attacker can inject CR/LF into attacker-controlled input, causing arbitrary response headers to be added via reflected percent-decoded query parameters or bare LF in Cookie headers into Set-Cookie headers. This enables cach...

CVE-2026-66746

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...

EUVD-2026-49889

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...