CVE-2026-90154

CVE-2026-90154 affects the ksmbd subsystem of the Linux kernel . The function ksmbd_all_conn_set_status() incorrectly treats every connection with a transient binding flag as belonging to the target SessionId, so a logoff or session replacement can move an unrelated connection to NEED_RECONNECT o...

CVE-2026-90154 ksmbd: scope session state changes to bound connections

In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...

CVE-2026-90154 ksmbd: scope session state changes to bound connections

In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...

CVE-2026-90154: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: scope session state changes to bound connections ksmbdallconnsetstatus treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move...

EUVD-2026-77682

October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...

Astra Linux – Vulnerability in Thunderbird

The olmsessiondescribe function in Matrix libolm before version 3.2.7 is vulnerable to a buffer overflow. The Olm session object represents a cryptographic channel between two parties. Therefore, its state is partially controllable by the remote party of the channel. Attackers can construct a...

Astra Linux – Vulnerability in Samba

In DCE/RPC, it is possible to share handles cookies for resource state between multiple connections through a mechanism called “association groups”. These handles can reference connections to our sam.ldb database. However, while the database is correctly shared, the user credentials are only...

CVE-2026-55858

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The...

CVE-2026-55859 MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to charactersetclien...

CVE-2026-55859

MariaDB Connector/R2DBC (org.mariadb:r2dbc-mariadb) is a non-blocking Java client for MariaDB and MySQL. Prior to 1.4.1 , the driver encodes and decodes all character data assuming the connection character set is UTF-8 . A server can announce a mid-session change to character_set_client through t...

CVE-2026-55859 MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to charactersetclien...

PT-2026-83375

Name of the Vulnerable Software and Affected Versions MariaDB Connector/R2DBC versions prior to 1.4.1 Description The driver encodes and decodes all character data assuming the connection character set is UTF-8. A server can announce a mid-session change to the character set client variable throu...

CVE-2026-40203

When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can...

CVE-2026-80635: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from short trigger BA firmware response The firmware response length is only checked against sizeofrsp 20 bytes, but when candidatecnt = 1, a 22-byte candidate struct is read at buf + 20 without...

UBUNTU-CVE-2026-40203

When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can...

CVE-2026-66884 Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...

SUSE CVE-2026-55883

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebSocket at /ws/view is gated by a CSRF token, but the token is served by the unauthenticated /api/websockettoken endpoint and the upgrader accepts clients that omit an Origin...

CVE-2026-16326: Exposure of Data Element to Wrong Session

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, which may allow one client's Consul authentication token to be used for subsequent requests from other clients. This vulnerability CVE-2026-16326 is fixed in consul-mcp-server 0.1.4...

PT-2026-65880

Name of the Vulnerable Software and Affected Versions consul-mcp-server versions 0.1.0 through 0.1.3 Description In stateless mode, the software fails to properly isolate session state. This flaw may allow a Consul authentication token belonging to one client to be utilized for subsequent request...

CVE-2026-53383

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject non-VALID session in compound request branch smb2checkusersession takes a shortcut for any operation that is not the first in a COMPOUND request: it reuses work-sess the session bound by the first operation and...