EUVD-2026-82876

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

CVE-2026-21806 HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

CVE-2026-21806 HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

CVE-2026-21806

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application incorrectly allows multiple simultaneous authenticated sessions for the same administrative account, which may enable an unauthorized attacker to predict or hijack valid session ident...

CVE-2026-67103

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

CVE-2026-67103 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

CVE-2026-67103 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

CVE-2026-67103

HCL BigFix Service Management is affected by a Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject unsanitized malicious scripts executed in a victim's browser. The stated impact includes session hijacking , account takeover , and unauthorized actions on behalf of affected ...

EUVD-2026-82769

HCL BigFix Service Management is affected by Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users...

EUVD-2026-82689

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

CVE-2026-90977 Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

CVE-2026-90977 Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving it...

CVE-2026-90977

The Clean Login WordPress plugin prior to version 1.19 fails to verify the registration CAPTCHA when the stored session value is empty. This allows unauthenticated users to bypass the anti-automation control on the registration form and create accounts without solving the CAPTCHA. The vulnerabili...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

Summary Multiple vulnerabilities were addressed in IBM Sterling Partner Engagement Manager. Vulnerability Details CVEID:CVE-2025-13882 DESCRIPTION: IBM Sterling Partner Engagement Manager could allow an unauthenticated user to cause a denial of service in the email service due to improper control...

SUSE CVE-2026-89635

In the Linux kernel, the following vulnerability has been resolved: ksmbd: only rebind the reopened file's own oplock on durable reconnect ksmbdreopendurablefd walks the inode's moplist and rebinds every detached oplock to the reconnecting session: listforeachentryrcuop, &ci-moplist, opentry,...

SUSE CVE-2026-93050

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

CVE-2026-21806: Undefined Security Weakness

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers...

CVE-2026-75878: Improper Authentication

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header...

PT-2026-95581

Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.68 Description The password authentication flow for protected shared notes fails to rotate the session identifier after successful authentication, leading to session fixation. This occurs when an attacker obtai...

CVE-2026-92976: Insufficient Session Expiration

A stored Cross-Site Scripting XSS vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered is stored and displayed without being...