CVE-2026-49843 FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, modverto's JSON-RPC handler bound the connection to the client-supplied sessid on the fir...

PT-2026-47850

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.1 Description In the mod verto module, the JSON-RPC handler binds the connection to the client-supplied sessid during the first frame before the authentication gate. This binding process inserts the connection...

curl: libcurl: Integer truncation in curl_easy_ssls_import() causes TLS sessions to never expire

Summary: curleasysslsimport deserializes a TLS session blob and stores it in the in-memory session cache. In Curlsslsessionunpack lib/vtls/vtlsspack.c:311, the validuntil field is read as uint64t and cast directly to curlofft int64t with no bounds check — so a crafted blob encoding validuntil =...

Cisco Webex Meetings Input Validation Error Vulnerability

Cisco Webex Meetings is a videoconferencing solution from Cisco. A security vulnerability exists in Cisco Webex Meetings and Cisco Webex Meetings Server, which results from synchronization issues between meetings and media services on vulnerable Webex websites. An attacker could exploit the...

python-django: Denial-of-service possibility in logout() view by filling session store

It was found that certain Django functions would, in certain circumstances, create empty sessions. A remote attacker could use this flaw to fill up the session store or cause other users' session records to be evicted by requesting a large number of new sessions...

python-django: Denial-of-service possibility in logout() view by filling session store

It was found that Django incorrectly handled the session store. A session could be created by anonymously accessing the django.contrib.auth.views.logout view if it was not decorated correctly with django.contrib.auth.decorators.loginrequired. A remote attacker could use this flaw to fill up the...