PT-2026-96241

Name of the Vulnerable Software and Affected Versions x-ui version 0.3.2 Description A session invalidation flaw occurs because the full user object is stored in a client-side signed cookie. The authentication process only verifies that a user object can be retrieved from the cookie, failing to...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2 because the full user object is stored in a client-side signed cookie . The application's authentication mechanism only verifies that a user object can be retrieved from the cookie without re-validating against the database or checking a session ve...

EUVD-2026-84149

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-61687: Improper Authentication

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...

CVE-2026-94218: Missing Authorization

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication 2FA setup, through a client policy. A user can bypass this...

CVE-2026-79317: Insufficient Session Expiration

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-77519: Insufficient Session Expiration

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the ispermanent and expiretime checks used by the standard chat API. A previously valid,...

EulerOS Virtualization 2.10.1 : python-requests (EulerOS-SA-2026-3850)

According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made...

ROS-20260921-73-0019

The vulnerability in curl relates to the provision of data elements for an erroneous session. Exploiting this vulnerability can allow a perpetrator to enhance their privileges...

Exploit for CVE-2026-77812

CVE-2026-77812 — DJI Cleartext BLE Transmission of Wi-Fi PSK a...

BASM (Broken Authentication & Session Management) org.apache.sshd:sshd-core Dependency in Crucible Server

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in version 4.9.7 of Crucible Server. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 7.3 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N allow...

BASM (Broken Authentication & Session Management) org.apache.tomcat:tomcat-catalina Dependency in Jira Software Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 9.12.1, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This BASM Broken Authentication & Session Management...

BASM (Broken Authentication & Session Management) org.apache.tomcat:tomcat-catalina Dependency in Jira Service Management Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This BASM Broken Authentication & Session Management...

BASM (Broken Authentication & Session Management) org.apache.tomcat:tomcat-catalina Dependency in Bamboo Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 10.1.1, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

BASM (Broken Authentication & Session Management) io.netty:netty-handler Dependency in Jira Service Management Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This BASM Broken Authentication & Session Management...

BASM (Broken Authentication & Session Management) io.netty:netty-handler Dependency in Bamboo Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

BIT-ZOOKEEPER-2026-79993 Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode

The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. This opcode is considered internal-only and the official clie...

CVE-2026-88824

The Master Blocks WordPress plugin versions before 1.5.0 (specifically 1.4.1-1.4.1.4 ) contains an unauthenticated Stored XSS vulnerability. The root cause is a lack of authorization on one of its REST routes , which allows unauthenticated users to update plugin settings. A specific value updated...

SUSE CVE-2026-89788

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree connection use-after-free in smb2treeconnect ksmbdtreeconnconnect publishes a new tree connection in sess-treeconns with a single reference and returns its pointer to smb2treeconnect. The handler continues to...