ROS-20260922-73-0055

The vulnerability in Tomcat11 is related to incorrect session duration. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

EUVD-2026-84489

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load reads sessionid directly from the request cookie and loads that session from the store, and save writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated sta...

EUVD-2026-84490

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can...

PT-2026-96736

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A stored cross-site scripting XSS issue exists in the admin email composition screen. The organization name setting is interpolated directly into a JavaScript string literal using an unescaped P...

PT-2026-97042

Name of the Vulnerable Software and Affected Versions Autonomy Logic OpenPLC version 3 Description An improper neutralization of input during web page generation occurs in the web interface when routing programs based on a query string parameter that is not encoded. This cross-site scripting XSS...

CVE-2026-75517: Authorization Bypass Through User-Controlled Key

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration by integrationId and organizationId...

PT-2026-96829

Name of the Vulnerable Software and Affected Versions hex.pm versions 2025-10-10 through 2026-09-21 Description An insufficient session expiration issue in OAuth token issuance allows users whose organization membership or session has ended to continue reading private packages and documentation...

PT-2026-96809

Name of the Vulnerable Software and Affected Versions Lantronix SLC8000 affected versions not specified Lantronix SLC9000 affected versions not specified Lantronix EMG8500 affected versions not specified Lantronix EMG7500 affected versions not specified Lantronix SLB882 affected versions not...

CVE-2026-79312

The webpy web.py 0.76 framework is vulnerable to Session Fixation . The flaw exists because the Session._load() component reads the session_id directly from the request cookie to load sessions from the store, while the _save() method writes back using that same ID. Because there is no rotation of...

PT-2026-96773

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session. load reads session id directly from the request cookie and loads that session from the store, and save writes back under the same session id; no rotation after authentication, so a fixed session id keeps the authenticated...

CVE-2026-79312

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load reads sessionid directly from the request cookie and loads that session from the store, and save writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated sta...

PT-2026-97022

Name of the Vulnerable Software and Affected Versions Nautobot versions prior to 2.4.37 Nautobot versions prior to 3.1.8 Description Users with specific permissions can store HTML or JavaScript in a Relationship description or a Module Family name. Nautobot assigns these values to form field help...

CVE-2026-79313

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can...

PT-2026-96723

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A reflected cross-site scripting XSS issue exists in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a...

CVE-2026-79313

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can...

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

PT-2026-96986

Name of the Vulnerable Software and Affected Versions Adobe Connect affected versions not specified Description A stored Cross-Site Scripting XSS issue exists where an attacker can inject malicious scripts into vulnerable form fields. When a victim visits the page containing the affected field, t...

OpenCast etc/security/mh_default_org.xml Unauthorized Access

The vulnerability in the script of etc/security/mhdefaultorg.xml of the application for automatic capture, processing, management, and distribution of Opencast videos is related to improper session management when processing the JSESSIONID parameter. Exploiting this vulnerability may allow an...

Unity Linux 20.1060e / 20.1070e Security Update: wpa_supplicant (UTSA-2021-001733)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2021-001733 advisory. The implementations of EAP-PWD in wpasupplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...