CVE-2026-50812

A flaw was found in SQLite. The Session Extension in SQLite is vulnerable to a NULL pointer dereference. A remote attacker could exploit this by supplying a specially crafted, malformed changeset blob. This could lead to a denial of service, making the application unavailable to legitimate users...

CVE-2026-17251

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

CVE-2026-17251 Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

EUVD-2026-64007

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

CVE-2026-17251 Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

CVE-2026-17251

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of the TP-Link TL-MR6400 v7 router. An unauthenticated attacker on the adjacent network can trigger the flaw by sending a crafted HTTP request containing a malformed session cookie header , causing the HTTP ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through unbounded session retention in the handleInitRequest path of WebFluxStreamableServerTransportProvider and WebMvcStreamableServerTransportProvider. An unauthenticated remote...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to axios-1.12.2.tgz (CVE-2026-25639, CVE-2026-39865)

Summary Axios is vulnerable to a Improper Check for Unusual or Exceptional Conditions Complete Denial of Service DoS, Uncontrolled Resource Consumption forcefully crashing the client application backend attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details...

CVE-2026-59279 Unbounded persistent session allocation via repeated initialize requests

The MCP Streamable HTTP server transport WebFlux and WebMvc variants does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over...

CVE-2026-59279

Spring AI 2.0.0 is affected by a Denial of Service vulnerability in the MCP Streamable HTTP server transport (both WebFlux and WebMvc variants). The transport does not impose any limit on the number of sessions it retains and, by default, does not require client authentication. A remote unauthent...

CVE-2026-59279 Unbounded persistent session allocation via repeated initialize requests

The MCP Streamable HTTP server transport WebFlux and WebMvc variants does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over...

Splunk Enterprise’s vulnerabilities are exploited through Splunk

Splunk has identified several vulnerabilities in Splunk Enterprise, particularly in versions prior to 10.4.2, 10.2.6, 10.0.9, and 9.4.14. These vulnerabilities include: - Inadequate enforcement of authentication and authorization checks in REST APIs, allowing unauthorized users to access sensitiv...

CVE-2025-15671

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

Malicious code in express-session-handler (npm)

Source: amazon-inspector 0e94450f5541b39d8310a8b640dee027b0970db6e7cf724352726d49393bfb77 The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin routine in index.js that performs an HTTPS fetch to...

Malicious Package

Overview express-session-handler is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious code in mcq-session (npm)

Source: amazon-inspector 1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b On any require/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public/logo.ico a path escaping the package root into a host application's public assets,...

Malicious Package

Overview mcq-session is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

CVE-2025-15671

The Welcart e-Commerce WordPress plugin, in versions before 2.12.1 , is vulnerable to a session fixation attack. The flaw exists because the plugin fails to regenerate the session identifier upon authentication and allows the session identifier to be set from a user-supplied request parameter (sp...

EUVD-2025-210759

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

CVE-2025-15671 Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...