1516 matches found
CVE-2026-60053
Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...
CVE-2026-60053
CVE-2026-60053 affects Apache Answer up to version 2.0.1. The issue is an insufficient session expiration that left Administrative API keys usable after the owning administrator was demoted or the account marked inactive, suspended, or deleted, enabling continued access until keys are removed. Th...
EUVD-2026-53402
Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...
CVE-2026-14465
Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
EUVD-2026-52654
Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
CVE-2026-14465 Session Fixation in Bilin Software's HUMANIST Digital Human Resources
Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
CVE-2026-14465
Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs aka Session Replay. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
Progress MOVEit Transfer < 2025.1.5 / 2026.0.x < 2026.0.3 Multiple Vulnerabilities (July 2026)
The version of Progress MOVEit Transfer installed on the remote host is prior to 2025.1.5 or 2026.0.x prior to 2026.0.3. It is, therefore, affected by multiple vulnerabilities: - Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. CVE-2026-159...
EUVD-2026-51258
An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an...
CVE-2026-14227
The CVE-2026-14227 entry describes an API session-management vulnerability in MikroTik RouterOS when the API is enabled. The flaw allows an active session to retain its previous permission set after inactivity timeouts or user-group changes, meaning an authenticated user whose permissions have be...
CVE-2026-14227 Insufficient session expiration in MikroTik RouterOS
An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an...
PT-2026-66546
An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an...
CVE-2026-67430
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust proces...
CVE-2026-66400
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...
EUVD-2026-50324
Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the...
CVE-2026-66400
Grav Login Plugin = 3.8.13 or follow vendor advisories cited in the references to mitigate.
PT-2026-65897
Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem does not expire sessions by default. Consequently, repeated initialize requests lead to the retention of unbounded...
CVE-2026-15967
Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...
CVE-2026-15967
Issue: Insufficient session expiration in Progress MOVEit Transfer. Affected versions: MOVEit Transfer before 2025.1.5, and 2026.0.0 before 2026.0.3 (i.e., 2026.0.0–2026.0.2). Root cause: Sessions do not expire sufficiently, potentially allowing continued access to active sessions. Impact: High i...