CVE-2026-90443 Cross-site Scripting in Malcolm

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in...

EUVD-2026-75870

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

Apache Artemis 1.0.0 < 2.45.0 / 2.50.0 < 2.57.0 Multiple Vulnerabilities

The version of Apache Artemis formerly Apache ActiveMQ Artemis installed on the remote host is affected by multiple vulnerabilities: - An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously...

CVE-2026-36392

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

EUVD-2026-75577

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

CVE-2026-49363

A missing authentication vulnerability was found in Apache ActiveMQ Artemis. The SUBSCRIBETOPOLOGYV2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket processes topology subscription requests on channel0 with zero authentication -- no call to getSecurityStore, no credential...

CVE-2026-57967

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

CVE-2026-57967

An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0...

CVE-2026-57967 Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0...

EUVD-2026-75246

An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0...

CVE-2026-57967

An unauthenticated remote attacker can exploit a session hijack vulnerability in Apache Artemis (versions 2.50.0 through 2.56.0) and Apache ActiveMQ Artemis (versions 1.0.0 through 2.44.0). The REATTACH_SESSION handler performs zero authentication, looking up sessions by name only and calling tra...

PT-2026-89649

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

CVE-2026-36392

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

PT-2026-89378

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

CVE-2026-36392: Improper Neutralization of Input During Web Page Generation

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

CVE-2026-36392

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

CVE-2026-36392

FairSketch Rise CRM (versions

CVE-2026-64857

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

CVE-2026-64857

tirreno , a security framework, is affected by a session fixation vulnerability in versions prior to 0.10.0 . During login, tirreno validates credentials and establishes the authenticated session but fails to call session_regenerate_id(), leaving the session identifier unchanged before and after ...

CVE-2026-64857 tirreno has Session Fixation in Login Authentication

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...