CVE-2026-62646

CVE-2026-62646 affects Reyrolle 7SR5 (all versions prior to V2.70 ), a Siemens industrial communication gateway. The vulnerability resides in the session identifier generation mechanism: an algorithm with insufficient randomness produces low-entropy tokens that can be predicted or brute-forced. A...

CVE-2026-62646

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an...

EUVD-2026-72660

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device...

CVE-2026-62645

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device...

CVE-2026-62645

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device...

CVE-2026-62645

A vulnerability in Reyrolle 7SR5 (all versions prior to V2.70 ) exposes information through the web interface that allows an attacker to calculate current and past session ID numbers . This enables authentication bypass and unauthorized access to the device. The vulnerability is rated CVSS 3.1: 9...

EUVD-2026-72659

A vulnerability has been identified in Teamcenter V2412 All versions V2412.0013, Teamcenter V2506 All versions V2506.0010, Teamcenter V2512 All versions V2512.2607, Teamcenter V2606 All versions V2606.2607. Affected applications do not properly encode user-supplied input reflected into HTML...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

xmlrpc-c: XMLRPC-C Library: Cross-Site Scripting in error page component

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

CVE-2026-19397

CVE-2026-19397 is a missing authentication vulnerability in ASUS Control Center Express Agent . When the host has an active login session, an unauthenticated user on the adjacent network can directly connect to the agent and control the host. The flaw affects a critical function within the agent ...

CVE-2026-66767

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

CVE-2026-66767 Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

CVE-2026-66767 Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

EUVD-2026-72576

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

CVE-2026-66767

CVE-2026-66767 is a memory corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an unauthenticated user to send a specially crafted packet triggering reprocessing of a previously buffered user request , potentially hijacking another user's session un...

CVE-2026-84869: Missing Authorization

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted...

CVE-2026-76196: Session Fixation

Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain access to sensitive resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user...

CVE-2026-62645: Missing Authentication for Critical Function

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device...

VulnCheck KEV: CVE-2026-84869

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation...

PT-2026-87121

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a...