Socket.IO: Engine.IO WebTransport SID DoS

Impact Engine.IO servers with WebTransport enabled are vulnerable to a remotely triggerable denial of service. A malicious unauthenticated client can send a crafted WebTransport upgrade request containing a specially chosen session ID, such as proto. Because the session ID lookup did not properly...

CVE-2026-82909

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

CVE-2026-82909 QuantumNous new-api Revoked API Token token session expiration

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

CVE-2026-82909 QuantumNous new-api Revoked API Token token session expiration

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

EUVD-2026-68773

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

CVE-2026-82909

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

CVE-2026-82909 QuantumNous new-api Revoked API Token token session expiration

A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote...

CVE-2026-82909

QuantumNous new-api versions up to 1.0.0-rc.15 are affected by a vulnerability in the Revoked API Token Handler (file /api/usage/token/). Manipulation of an unknown function in this component can lead to session expiration . The attack is remote and requires low privileges , with a low confidenti...

Updated perl-Catalyst-Plugin-Authentication packages fix a security vulnerability

Catalyst::Plugin::Authentication versions before 0.10027 for Perl are susceptible to session fixation attacks. CVE-2009-10007...

MGASA-2026-0351 Updated perl-Catalyst-Plugin-Authentication packages fix a security vulnerability

Catalyst::Plugin::Authentication versions before 0.10027 for Perl are susceptible to session fixation attacks. CVE-2009-10007...

CVE-2026-73180

A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...

CVE-2026-82816

A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been...

CVE-2026-79745 MCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts and...

CVE-2026-82816

dibo-software diboot 3.8.0 contains an authorization bypass in the AI Session Endpoint (/api/ai-session/). The flaw allows a remote attacker with low privileges to bypass authorization with low complexity and no user interaction, impacting confidentiality, integrity, and availability at a low lev...

EUVD-2026-68683

A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been...

CVE-2026-82816 dibo-software diboot AI Session Endpoint ai-session authorization

A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the component AI Session Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The exploit has been...

Important: Red Hat Security Advisory: libssh2 security update

An update for libssh2 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

libssh2: libssh2: Arbitrary code execution via double-free in SFTP session

A flaw was found in libssh2. A malicious SSH Secure Shell server can exploit a double-free vulnerability in the sftpopen function. This flaw allows the server to corrupt the heap memory of an authenticated client when it opens an SFTP SSH File Transfer Protocol session. This heap corruption can...

BASM (Broken Authentication & Session Management) at Bouncy Castle Dependency in Crucible Server

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-59639 was introduced in 4.9.0 and later of Crucible. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

nodejs: HTTPS Agent TLS session reuse skips hostname verification

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...