1956 matches found
CVE-2026-82590 Open5GS SMF nudm-handler.c smf_nudm_sdm_handle_get assertion
A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...
CVE-2026-26456
A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes withou...
EUVD-2026-67097
A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes withou...
CVE-2026-26456
A null pointer dereference vulnerability exists in the server-side session management logic of ccoap (commit 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5). The root cause is a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes wi...
CVE-2026-26456
A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes withou...
CVE-2026-73180
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...
UBUNTU-CVE-2026-73180
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...
CVE-2026-24166
NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. A successful exploit of this vulnerability might lead to information disclosure and escalation of privileges...
EUVD-2026-65612
NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. A successful exploit of this vulnerability might lead to information disclosure and escalation of privileges...
CVE-2026-24166
NVIDIA UFM Enterprise has a vulnerability in its session management component caused by a hard-coded cryptographic key . An attacker with local access could exploit this to extract information, potentially leading to information disclosure and escalation of privileges . The CVSS 3.1 score is 5.1 ...
TYPO3-EXT-SA-2026-015: Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015...
EUVD-2026-63221
An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...
EUVD-2026-62454
phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cook...
EUVD-2026-62206
This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perfor...
CVE-2026-21582
This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perfor...
CVE-2026-65984
FUXA (web-based SCADA/HMI/Dashboard software) versions 1.3.2 and earlier contain a JWT lifecycle flaw in two endpoints: POST /api/refresh in server/api/auth/index.js falls back to decoded.groups when the user record is missing or groups is zero, and POST /api/heartbeat in server/api/index.js re-s...
CVE-2026-65984 FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js...
CVE-2026-65984 FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions
FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js...
BASM (Broken Authentication & Session Management) in Jira Data Center
This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-21582 was introduced in version 9.12.14, 10.3.0, and 11.3.0 of Jira Software Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.8, allows an...
