EUVD-2026-119736

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions...

CVE-2026-8640

The IBM Security Verify Directory Web Application is vulnerable to Cross-Site Request Forgery (CSRF) attacks because it fails to set the SameSite attribute on session cookies. This flaw allows an attacker to induce authenticated users' browsers to transmit unauthorized requests to the application...

EUVD-2026-119735

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the...

EUVD-2026-119734

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console...

CVE-2026-8639

IBM Security Verify Directory versions 10.0.0 through 10.0.4 and IBM Verify Directory version 11.0.0 are vulnerable to session fixation (CWE-384). An attacker can establish a session and hijack it after a victim authenticates, leading to unauthorized access to the directory management console. To...

ReadyScript e-commerce management system Session Management

The vulnerability of the ReadyScript e-commerce management system is related to improper session management. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

HostCMS Sensitive Information Disclosure

The vulnerability in the HostCMS website management system is related to the exposure of sensitive information via metadata. Exploitation of this vulnerability enables a remote attacker to intercept user sessions and gain access to the user account...

FOQUZ Platform Session Duration

The vulnerability of the FOQUZ platform is related to an incorrect session duration. Exploiting this vulnerability can allow attackers to compromise the confidentiality and integrity of the protected information...

FOQUZ Platform Privilege Escalation

The vulnerability of the FOQUZ platform is related to an incorrect session duration. Exploiting this vulnerability can allow a remote attacker to increase their privileges and gain unauthorized access to protected information...

CVE-2026-124493

SunEditor versions prior to 3.4.0 are vulnerable to a stored cross-site scripting (XSS) flaw within the DocumentType constructor . The root cause is the injection of header textContent into innerHTML without proper HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers, which exe...

EUVD-2026-119548

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mo...

CVE-2026-124491

SunEditor versions prior to 3.4.0 are susceptible to a stored cross-site scripting (XSS) vulnerability within the FileUpload plugin 's create() method. The root cause is the assignment of server-returned file names to innerHTML without proper escaping. Attackers can upload files with malicious, H...

EUVD-2026-119546

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...

CVE-2026-124452

OpenEMR versions prior to 8.3.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability located in interface/forms/eye_mag/report.php. The root cause is the application's failure to escape document notes, allowing authenticated users with write access to inject malicious JavaScript in...

EUVD-2026-119510

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...

CVE-2026-124448

OpenEMR versions before 8.3.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the CCDA/CCD preview stylesheets . The root cause is that cda.xsl copies event-handler attributes that evade a character denylist, while ccd.xsl copies unsanitized table-cell attributes into t...

login-range

login-range A self-contained attack range for login pages...

CVE-2026-123550

OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP PAOS and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions a...

CVE-2026-123539

OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name executes script that can steal the OpenAM...

CVE-2026-123528

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account...