CVE-2026-111241

When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in the shared system temporary directory, reusing files that already exist there, and is deserialized on activation. A local attacker who can write to that...

EUVD-2026-121215

Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other...

EUVD-2026-121214

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are...

PT-2026-141725

Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other...

PT-2026-141724

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are...

CVE-2026-121881 Posit Workbench code-server session-state RPC (get_last_seen) SQL injection

SQL injection vulnerability in the getlastseen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. NOTE: exploitation requires a valid authenticated sessio...

CVE-2026-121881

An SQL injection vulnerability exists in the get_last_seen code-server session-state RPC of Posit Workbench (versions before 2026.08.0 ) by Posit Software, PBC. The flaw is caused by improper handling of the sessionIds parameter, which allows authenticated users to read arbitrary data from the Wo...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes. However, when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

Astra Linux – vulnerability in linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: ksmbd: changes in the scope session state affect bound connections ksmbdallconnsetstatus treats every connection where the transient binding flag is set as belonging to the target SessionId. Consequently, a logoff or session...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109619: PHP stale session state, isolated lab reprodu...

PHP 8.5.11 Remote Code Execution

PHP versions prior to 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain remote code execution vulnerabilities. This script performs behavioral checks for affected request parsing and session state handling...

GO-2026-6715 Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

PT-2026-118033

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

Astra Linux – vulnerability in Thunderbird

The olmsessiondescribe function in Matrix’s libolm prior to version 3.2.7 is vulnerable to a buffer overflow. An Olm session object represents a cryptographic channel between two parties; thus, its state can be partially controlled by the remote party. Attackers can craft a sequence of messages t...

CVE-2026-55167

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...

CVE-2026-59951

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamablehttpapp, and StreamableHTTPSessionManager, retain session entries without an id...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions when processing an oversized cookie parameter from a remote endpoint in the cookie process. An attacker can cause the loss of session state by serving a specially crafted cookie that...

CVE-2026-82416

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVEPHPSESSION at compile time. In this build configuration,...

CVE-2026-90154

A flaw was found in ksmbd, a server message block SMB protocol implementation within the Linux kernel. This vulnerability arises from improper management of session state changes, which can cause the system to incorrectly associate active network connections with an unintended session. As a resul...

PT-2026-111732

Name of the Vulnerable Software and Affected Versions FrankenPHP versions prior to 1.12.5 Description In worker mode, the application server may retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE PHP SESSION at compile...