PT-2026-66598

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard version 3.0.0 Description A stored cross-site scripting issue exists where unauthenticated remote attackers can inject arbitrary HTML and script payloads. This occurs when a crafted username is submitted in a failed login PO...

PT-2026-66280

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.72 Description An inappropriate implementation in the Session component allows a remote attacker to bypass navigation restrictions by using a crafted HTML page. Recommendations Update Googl...

CVE-2026-16970: Insufficient Session Expiration

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time...

PT-2026-66446

Name of the Vulnerable Software and Affected Versions IRIS web application version 2.4.26 Description The logout functionality is ineffective, allowing stolen session cookies to be misused for an extended period. Recommendations At the moment, there is no information about a newer version that...

MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Improper Access Control (SERVER-127689)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, or 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user may be able to view session metadata belonging to other users on the system through the $listSession...

Linux Distros Unpatched Vulnerability : CVE-2026-56848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a...

CVE-2026-54364: Improper Encoding or Escaping of Output

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit th...

CVE-2026-58040: Improper Validation of Certificate with Host Mismatch

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies incomplete fix of CVE-2026-48934. This vulnerability affects Node.js 22.x, 24.x, and 26.x...

PT-2026-66454

Name of the Vulnerable Software and Affected Versions Eaton Tripp Lite Series PADM firmware affected versions not specified Description Improper input validation in a session management interface allows an authenticated administrator to execute arbitrary commands within a restricted environment...

PT-2026-66455

Name of the Vulnerable Software and Affected Versions Eaton Tripp Lite PADM firmware affected versions not specified Description Improper input validation in a session management interface allows an authenticated user to elevate privileges, potentially granting unrestricted access to the device...

CVE-2024-40683: Insufficient Session Expiration

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

CVE-2026-13117: Use After Free

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage...

CVE-2026-12996: Use After Free

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

Linux RxRPC DoS

The vulnerability in the rxrpcserverkeyring function within the net/rxrpc/serverkey.c module, which handles RxRPC session sockets on Linux operating systems, is related to errors occurring during reference count updates. Exploitation of this vulnerability may allow an attacker to cause a denial o...

PT-2026-66628

Name of the Vulnerable Software and Affected Versions OpenClaw Dashboard affected versions not specified Description A stored cross-site scripting issue exists that allows unauthenticated remote attackers to execute arbitrary JavaScript in an administrator's browser session. This occurs when HTML...

PT-2026-66546

An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an...

PT-2026-66465

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit th...

PT-2026-66409

Name of the Vulnerable Software and Affected Versions Node.js versions 22.x Node.js versions 24.x Node.js versions 26.x Description An incomplete fix exists in the HTTPS Agent where TLS session reuse allows the system to skip hostname verification across identity policies. Recommendations Update...

IBM WebSphere Application Server Input Validation Vulnerability (CNVD-2026-31548)

IBM WebSphere Application Server is an application server product developed by IBM. There is a security vulnerability in IBM WebSphere Application Server, which stems from improper handling of HTTP version tokens. Attackers can exploit this vulnerability to perform HTTP response smuggling attacks...

PT-2026-66622

Name of the Vulnerable Software and Affected Versions MeshCentral version 1.1.21 Description A cross-site WebSocket hijacking protection bypass occurs when self-signed certificates are used. This is caused by an unconditional early return in the CheckWebServerOriginName function within...