1946 matches found
MINI-HRPC-H9CW-67RM
Bulletin has no description...
EUVD-2026-59517
In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luosessionretrieve Extend the scope of the rwsemread lock in luosessionretrieve to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freeing the...
PT-2026-72806
In the Linux kernel, the following vulnerability has been resolved: liveupdate: fix TOCTOU race in luo session retrieve Extend the scope of the rwsem read lock in luo session retrieve to overlap with the acquisition of the session mutex. This prevents a concurrent thread from releasing and freein...
CVE-2026-17045
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...
EUVD-2026-58388
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...
CVE-2026-17045
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...
CVE-2026-17045 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...
CVE-2026-17045
CVE-2026-17045 affects IBM i 7.6, 7.5, 7.4, and 7.3 due to improper session management that can allow a remote authenticated attacker to perform unauthorized operations and access sensitive information. The vulnerability is categorized under CWE-294 (Authentication Bypass by Capture-replay) with ...
CVE-2026-56750 Gitea Remember-Me Token Theft Not Invalidating Attacker Session
Gitea Remember-Me Token Theft Not Invalidating Attacker Session...
PT-2026-71828
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management...
io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation
A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...
CVE-2026-50159 vulnerabilities
Vulnerabilities for packages: langfuse...
CVE-2026-68188 Bluetooth: RFCOMM: Fix session UAF in set_termios
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix session UAF in settermios rfcommttysettermios tests dlc-session without rfcommmutex and later passes the pointer to rfcommsendrpn. The latter dereferences both session-initiator and session-sock. Meanwhile,...
EUVD-2026-55511
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroyprevioussession until after NTLM authentication In ntlmauthenticate, destroyprevioussession is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response ...
PT-2026-69989
Name of the Vulnerable Software and Affected Versions PingFederate versions prior to 13.1 Description Cross-Site Request Forgery CSRF weaknesses in the Administrative Console may allow actors to perform unauthorized actions. This occurs when administrators with active sessions are triggered to...
CVE-2026-48079
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...
CVE-2026-70606 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession...
BASM (Broken Authentication & Session Management) in Crowd Data Center
This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perfor...