Action Pack: Possible sensitive session information leak in Active Storage proxy mode

Impact When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret config.actiondispatch.cookiesrotations or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write...

GHSA-X6MJ-8JX9-QHQV Action Pack: Possible sensitive session information leak in Active Storage proxy mode

Impact When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret config.actiondispatch.cookiesrotations or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write...

CVE-2026-126077

The Action Pack framework is vulnerable to a sensitive session information leak prior to versions 8.1.4.1 and 8.0.5.2 . The root cause is that ActionDispatch::Cookies fails to respect request.session_options[:skip] when rewriting signed or encrypted cookies written under a rotated secret or a :hy...

CVE-2026-126077 Action Pack: Possible sensitive session information leak in Active Storage proxy mode

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret config.actiondispatch.cookiesrotations or in the format that a :hybrid cookie serializer...

PT-2026-140391

Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise...

CVE-2026-66912 Stored Cross-Site Scripting in Zimbra

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

CVE-2026-66912

The Zimbra mail server is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of the From email header value. An attacker can send a crafted email containing a malicious JavaScript payload in the header. When a victim opens this message in the Classic UI and clicks Re...

EUVD-2026-112942

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

CVE-2026-66912: Synacor Zimbra Collaboration: Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in…

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

PT-2026-132283

Zimbra is vulnerable to Stored Cross-Site Scripting XSS via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript...

CVE-2026-89075 MOVEit Transfer Local Disclosure of Session Information Vulnerability

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89075 MOVEit Transfer Local Disclosure of Session Information Vulnerability

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89075

Progress MOVEit Transfer is affected by an Insecure Storage of Sensitive Information vulnerability (CWE-922). The issue specifically impacts versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4 . This vulnerability allows for the local disclosure of session information . Exploitati...

CVE-2026-76972

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

CVE-2026-89117 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-89117 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-76972 Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

CVE-2026-76972

A Cross-Site Scripting (XSS) vulnerability exists in SAP Manufacturing Integration and Intelligence (CWE-79). The root cause is the improper neutralization of input during web page generation, allowing an attacker to store malicious content that is subsequently rendered by the application. If an ...

CVE-2026-76972 Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

EUVD-2026-98185

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...