EUVD-2026-87096

The AIL Framework crawler splash domain page showDomain.html is vulnerable to stored cross-site script injection XSS. User-supplied data originating from imported crawler captures—specifically item IDs, URLs, and screenshot file paths—was interpolated directly into inline JavaScript contexts with...

CVE-2026-100176 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100176 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100176 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

EUVD-2026-87089

The AIL Framework's username timeline feature is vulnerable to stored cross-site scripting XSS. Usernames imported from chats and crawled forums are stored without character restrictions. When an authenticated analyst views the username timeline, the application renders these stored usernames int...

CVE-2026-100176

The AIL Framework username timeline feature is vulnerable to stored cross-site scripting (XSS) . The application stores usernames from chats and crawled forums without character restrictions. When an authenticated analyst views the timeline, the client-side JavaScript file var/www/static/js/d3/ti...

EUVD-2026-87087

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-98115

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

AZL-104675 CVE-2026-98115 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

DEBIAN-CVE-2026-98115

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

UBUNTU-CVE-2026-98115

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

CVE-2026-98115 ksmbd: safely drain sessions during logoff

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

CVE-2026-98115

The Linux kernel contains a vulnerability in ksmbd regarding the handling of SMB3 multichannel requests. The issue arises because shared session objects may be freed before all bound channels are processed. Additionally, a deferred byte-range lock can remain counted as a running request, waking o...

CVE-2026-98115

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

CVE-2026-98115 ksmbd: safely drain sessions during logoff

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

CVE-2026-79313

A flaw was found in webpy. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. This allows an attacker holding a previously valid session cookie to replay and use an expired session. As a result, an...

CVE-2026-92609

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...

CVE-2026-92609

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...

EUVD-2026-86581

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...

CVE-2026-92609 Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication

Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a session identifier retained across successful authentication. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended...