66624 matches found
CVE-2026-4637
Paessler PRTG Network Monitor (versions before 26.2.120.1449 ) is vulnerable to a reflected Cross-Site Scripting (XSS) flaw. The issue occurs because the web interface returns an HTTP 403 "Forbidden Path" error page for non-existent resources ending in ".htm" and echoes the requested URL path int...
CVE-2026-4637 Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor
Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...
CVE-2026-4637 Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor
Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting XSS vulnerability. When a request is made for a non-existent resource ending in ".htm", the web interface returns an HTTP 403 "Forbidden Path" error page that echoes the requested URL path...
CLEANSTART-2026-GK10237 Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does
CVE-2026-82311 affects multiple packages. Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour that it does. See references for individual vulnerability details...
CLEANSTART-2026-QU51579 Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions
CVE-2026-86462 affects multiple packages. Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. See references for individual vulnerability details...
CVE-2026-97176 Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator
A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...
CVE-2026-97176 Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator
A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...
CVE-2026-97176
A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...
CVE-2026-97055
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...
CVE-2026-97056
SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...
CVE-2026-97056 SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass
SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...
CVE-2026-97056 SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass
SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...
EUVD-2026-85773
SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...
CVE-2026-97056 SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass
SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...
CVE-2026-97056
SigNoz versions v0.98.0 through v0.142.x are vulnerable to insufficient session expiration when using the opaque session tokenizer . The root cause is that the UpdatePasswordByResetPasswordToken and DeleteUser code paths fail to call DeleteTokensByUserID, leaving cached tokens active. An attacker...
CVE-2026-97055 SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...
EUVD-2026-85774
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...
CVE-2026-97055 SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...
CVE-2026-97055 SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret tokenizer::jwt::secret, set via SIGNOZTOKENIZERJWTSECRET or the deprecated SIGNOZJWTSECRET to an empty string, and Config.Validate does not reject the empty value, so a deployment that does not configure a secret starts ...
CVE-2026-97055
SigNoz versions v0.8.0 before v0.143.0 are vulnerable to an authentication bypass because the JWT tokenizer signing secret defaults to an empty string. Since Config.Validate() fails to reject empty values, deployments without a configured secret sign and verify session tokens with an empty HMAC k...