CVE-2026-128335

The Contao CMS (versions 4.6.0 before 5.3.54 , 5.4.0-RC1 before 5.7.17 , and 6.0.0-RC1 before 6.0.6 ) is vulnerable to a Session Invalidation Failure when modifying two-factor authentication (2FA) settings. The root cause is that the Contao\User::isEqualTo() function and serialized session data d...

CVE-2026-50744

A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked...

CVE-2025-55264 HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change

HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control over the account despite the password change leading to account takeover...