CVE-2026-81826

Flowintel (versions >=3.3.0 ) fails to revoke existing authenticated sessions when a user's password is changed. An attacker who already holds a valid session token retains access until that session expires naturally, even after the victim changes their password. The fix detects password chang...

CVE-2026-77034

CVE-2026-77034 affects the Joomla Event Manager extension (versions prior to 5.0.1 ). The vulnerability allows an unauthenticated visitor holding their own session token to republish and overwrite an article associated with an event, resulting in an integrity impact rated Low (CVSS 4.0 score: 6.9...

EUVD-2026-66865

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

CVE-2026-77034 Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event...

PT-2026-82844

Name of the Vulnerable Software and Affected Versions WatchGuard Dimension affected versions not specified Description WatchGuard Dimension records unredacted session identifiers for logged-in users within its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log t...

CVE-2026-54245 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an...

CVE-2026-79673

Ech0 before 4.4.3 has a scope enforcement bypass in the PUT /user endpoint. The endpoint is guarded by the profile:read scope—a read-only permission—yet it still allows write operations, including password changes . An attacker holding an admin's profile:read access token can reset that admin's p...

CVE-2026-79665 Ech0 before 4.5.1 Authorization Bypass via Session Tokens

Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non-admin users to access admin endpoints. Attackers can read system logs, visitor statistics, user emails, and subscribe to live WebSocket...

CVE-2026-78414

A cross-site scripting (XSS) vulnerability exists in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 (Linux, Windows, macOS). An adjacent-network attacker who controls a rogue Nx server on the same network segment can set that server's site name to a script p...

EUVD-2026-64898

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

CVE-2026-39915 TIM Flow < 26.0.6 CRLF Injection via rt Parameter

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers...

EUVD-2026-64892

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers...

PT-2026-80899

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Summary A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global...

GHSA-7Q96-F8XW-JV5J Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

Summary A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global...

EUVD-2026-62931

In Splunk SOAR versions below 8.6.0, a user with a valid Splunk SOAR account could use Representational State Transfer REST API filtering on playbook runs to recover session tokens that compromise all data available to the affected user. The information disclosure is possible because Splunk SOAR...

EUVD-2026-62916

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could use crafted report notification data to cause Splunk Secure Gateway to send a request to...

EUVD-2026-62903

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The...

PT-2026-80753

Name of the Vulnerable Software and Affected Versions Fleet affected versions not specified Description A SQL injection exists in the Okta conditional access integration. An attacker controlling a single enrolled host can provide a value via the host agent that is used in a database query without...