GHSA-8CJ9-R88M-8945 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Summary The password change form is vulnerable to CSRF, allowing an attacker to change a user password even the administrator by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20. Details The password change endpoint of Semaphore UI doe...

EUVD-2026-57311

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation...

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Summary The password change form is vulnerable to CSRF, allowing an attacker to change a user password even the administrator by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20. Details The password change endpoint of Semaphore UI doe...

CVE-2026-85181

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

CVE-2026-85181

CAT (dianping/cat) through 3.1.0 is vulnerable to session cookie forgery due to using Java String.hashCode as the sole integrity check without a server-side secret key. An attacker can compute valid checksums offline and, by setting the x-forwarded-for header, bypass IP-binding validation to crea...

CVE-2026-85181 CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

CVE-2026-85181 CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

PT-2026-85040

CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access...

CVE-2026-82697

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function sessionstart. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity...

CVE-2026-82697 sambitraj Student-Management-System session_start cookie httponly flag

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function sessionstart. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity...

CVE-2026-82697

CVE-2026-82697 affects the sambitraj Student-Management-System (a rolling-release GitHub project) up to commit 56ba287. The vulnerable component is the session_start function, which sets a session cookie without the httponly flag , allowing JavaScript access to the session cookie. The attack is r...

CVE-2026-47665

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...

CVE-2026-47665 Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...

PT-2026-82331

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3 Description Stored cross-site scripting occurs when file comments are stored as raw text and rendered into the page using innerHTML without sanitization. The backend only performs a length check, allowing a team...

CVE-2026-78655

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

CVE-2026-78655

Punk::Plugin::TOTP (Perl) versions before 0.05 allow an attacker to bypass the TOTP second-factor attempt limit by replaying a previously saved session cookie. Because Punk::Session stores the failure counter inside a signed client-side cookie, a saved cookie from before the failed attempts resto...

CVE-2026-78655 Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session. The POST handler on challengepath keeps the failure count as tries inside the totppending record in...

CVE-2026-78553

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

Astra Linux – Vulnerability in Flask

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client’s session...

EUVD-2026-64663

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...