CVE-2026-75010

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...

CVE-2026-75010: Incorrect Resource Transfer Between Spheres

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue only affects Roundcube instances using the password plugin with its modoboa driver...

PT-2026-76649

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3 Description The modoboa driver of the password plugin can leak a Modoboa API authentication token to a host controlled by the user through crafted sessi...

CVE-2026-73632

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73632 Apache Struts: Shared serialization state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-73631 Apache Struts: Shared parsing state in the JSON plugin

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...

CVE-2026-73631

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...

EUVD-2026-59605

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared across concurrent requests, allowing data associated with one request to become observable in another, and configured parsing limits not to be enforced as intende...

PT-2026-72883

Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the...

CVE-2026-68756

A party with write access to stored session data may affect JFrog Artifactory under specific conditions...

CVE-2026-68756

CVE-2026-68756 concerns a potential insecure deserialization in JFrog Artifactory. The CVE records indicate that a party with write access to stored session data may affect Artifactory under specific conditions. Connected sources (CVELIST) label the issue as potential insecure deserialization; no...

CVE-2026-68756 Potential insecure deserialization in JFrog Artifactory

A party with write access to stored session data may affect JFrog Artifactory under specific conditions...

EUVD-2026-57252

A party with write access to stored session data may affect JFrog Artifactory under specific conditions...

CVE-2026-68756 Potential insecure deserialization in JFrog Artifactory

A party with write access to stored session data may affect JFrog Artifactory under specific conditions...

PT-2026-71111

Name of the Vulnerable Software and Affected Versions JFrog Artifactory affected versions not specified Description An insecure deserialization issue exists where a party with write access to stored session data may affect the system under specific conditions. Insecure deserialization occurs when...

CVE-2026-68756: Deserialization of Untrusted Data

A party with write access to stored session data may affect JFrog Artifactory under specific conditions...

Myndr: Myndr CORS Misconfiguration

The CORS configuration on admin.myndr.net allowed any .myndr.net subdomain to read authenticated admin panel responses, including CSRF nonces and session data. This vulnerability could have been exploited to take over admin accounts...

PT-2026-70043

Name of the Vulnerable Software and Affected Versions SAPUI5 affected versions not specified Description SAPUI5 contains a Cross Site Scripting XSS flaw where a key user with content adaptation privileges can inject malicious script content into persisted application changes. This script executes...

CVE-2026-66771: Improper Neutralization of Input During Web Page Generation

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the...

VulnCheck KEV: CVE-2026-48294

Adobe Acrobat PDF Extension Chrome versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in tha...