CVE-2020-10199_POC-EXP

Affected versions + + EXP: python3 cve-2020-10199poc.py 1.1.1.1 8081 0.9567822851573897 edfca15e-c721-45e2-bdef-e8b3c6364ddb + + VER: Nexus Repository Manager OSS/Pro version...

Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID

Transmission 4.0.0 through 4.1.2 sends Access-Control-Allow-Origin: on RPC responses and advertises X-Transmission-Session-Id via Access-Control-Expose-Headers on the 409 session handshake. Any website a user visits can read the session-id nonce that guards against CSRF, enabling cross-origin...

details-for-CVE-2022-46505

details-for-CVE-2022-46505 MatrixSSL session resume bug 1. Description of bug An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that can decrypt secret data. 2. Affected version MatrixSSL...

CVE-2014-3466_PoC

Proof of Concept for CVE-2014-3466 GnuTLS buffer overflow: session id length check Information See: https://bugzilla.redhat.com/showbug.cgi?id=1101932 This is not a weaponized exploit. be warned: this python code is ugly, I pretty much handcrafted the ServerHello and spent only about five fifteen...

CVE-2023-0264

PoC for CVE-2023-0264 Keycloak vulnerability that allows session hijacking during authorization code flow See https://github.com/advisories/GHSA-9g98-5mj6-f9mv Prerequisites Docker curl jq python3 or another tool to serve static files on HTTP Steps to reproduce 1. Start Keycloak container with...

EUVD-2026-117156

tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients...

CVE-2021-27513-CVE-2021-27514

exploit-eyesofnetwork Version 5.3.5 up to 5.3.10 CVE-2021-27513 / CVE-2021-27514 The brute-forcing can take a very long time on non production environement cause "sessionid" is created at every login but every sessionid generated by the app are valide for the PoC i deployed an EyesOfNetwork...

CVE-2026-76893

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...

CVE-2026-76893 tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...

CVE-2026-76893

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...

tsParticles resource management error vulnerability

Versions of tsParticles prior to 4.3.2 and @tsParticles/mcp-server prior to 4.3.2 contain a resource management error vulnerability. This vulnerability arises because the HTTP mode of @tsParticles/mcp-server reuses the same stateful StreamableHTTPServerTransport for every client. Unauthenticated...

CVE-2026-76893: tsparticles, @tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...

PT-2026-137200

Name of the Vulnerable Software and Affected Versions VitaFit Android application versions prior to 2.8.1.0 Description Insecure session management allows the extraction or interception of unencrypted m session id tokens stored in application backups. These tokens remain valid for ten years,...

CVE-2026-121419

SurrealDB versions 3.1.0 through 3.3.0 are vulnerable to an improper authentication vulnerability. The flaw exists because the MCP BoundSubject fingerprint utilizes the access method name rather than a unique per-user identity for JWT/Bearer access. This oversight allows an attacker possessing a ...

CVE-2026-13575 HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters,...

CVE-2026-13575 HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters,...

CVE-2026-13575

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters,...

CVE-2026-13575

The HTTP::Session module for Perl (versions before 0.54 ) is vulnerable to memcached command injection via unfiltered session IDs in the HTTP::Session::Store::CHI component. The root cause is that the CHI store fails to validate or escape session IDs provided by client cookies, unlike its sibling...

EUVD-2026-114833

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters,...

CVE-2026-13575 HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI

HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI. The session id from the client's cookie reaches the CHI cache unchanged. The sibling HTTP::Session::Store::Memcached rejects ids that contain control characters,...