CVE-2026-9190: Inconsistent Interpretation of HTTP Requests

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

PT-2026-68317

Name of the Vulnerable Software and Affected Versions livebook versions 0.5.0 through 0.18.6 livebook versions 0.19.0 through 0.19.8 Description An origin validation error allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts. The JS-view feature renders JavaScrip...

PT-2026-68290

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description Improper validation of the username field allows attackers to inject path traversal sequences—a technique used to access files and directories outside the intended folder—and bypass...

PT-2026-68319

Name of the Vulnerable Software and Affected Versions livebook versions 0.15.0 through 0.18.6 livebook versions 0.19.0 through 0.19.8 Description A Cross-Site Request Forgery CSRF issue exists when Livebook is configured to use Livebook Teams for identity. The handle request/4 function in...

PT-2026-68099

Name of the Vulnerable Software and Affected Versions InvoiceNinja version 5-stable Description An authenticated user with invoice creation permissions can inject HTML or JavaScript payloads into the terms field of an invoice or quote. This occurs because the application renders this field in the...

CVE-2026-67591: Allocation of Resources Without Limits or Throttling

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue...

PT-2026-68193

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.2 Description Insufficient Session Expiration allows administrative API keys to remain active even after the associated administrator account is demoted, marked as inactive, suspended, or deleted. This resul...

CVE-2026-71206: Insufficient Session Expiration

Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase...

CVE-2026-18531: Use of Insufficiently Random Values

IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret...

PT-2026-68202

Name of the Vulnerable Software and Affected Versions IBM Maximo Application Suite versions 9.0 through 9.2 Description A remote attacker can tamper with session data because the system uses a weak HMAC Hash-based Message Authentication Code session signing secret. HMAC is a specific type of...

PT-2026-81371

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.74.4 Description The software fails to strip the X-Amz-Security-Token header when an S3 redirect changes the scheme from HTTPS to HTTP on the same host. This allows attackers to intercept plaintext HTTP traffic and...

PT-2026-68221

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...

CVE-2026-66275: Allocation of Resources Without Limits or Throttling

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue...

EUVD-2026-53010

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing t...

CVE-2026-46334 OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing t...

CVE-2026-46334

Technical details for CVE-2026-46334 are not provided in the supplied documents; only high-level info and fixes are available. Monitor for updates in the connected sources.

CVE-2026-70594

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted...

CVE-2026-58040

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

CVE-2026-45103

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. When an attacker sends a Content-Length value that overflows unsigned...

Ghost: Session Fixation in Ghost Admin

Impact Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful exploitation would have required another vulnerability on the same domain where Ghost Admin was hosted. Vulnerable versions This vulnerability is present in Ghost fro...