CVE-2026-45172 Idira Privileged Session Manager for SSH (PSMP): Arbitrary Command Execution via Improper Neutralization of Special Elements used in an OS Command

Due to incomplete input validation in Idira Privileged Session Manager for SSH PSMP versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18...

CVE-2026-45172 Idira Privileged Session Manager for SSH (PSMP): Arbitrary Command Execution via Improper Neutralization of Special Elements used in an OS Command

Due to incomplete input validation in Idira Privileged Session Manager for SSH PSMP versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18...

CyberArk Idira Privileged Session Manager: Operating System Command Injection Vulnerability

CyberArk Idira Privileged Session Manager is a privileged session management platform developed by the American company CyberArk. Versions of CyberArk Idira Privileged Session Manager for SSH prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6 contained an operating system command injection vulnerability...

CVE-2026-45171: Improper Limitation of a Pathname to a Restricted Directory

Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager PSM versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-1...

CVE-2026-45172: Improper Neutralization of Special Elements used in an OS Command

Due to incomplete input validation in Idira Privileged Session Manager for SSH PSMP versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18...

PT-2026-48788

Name of the Vulnerable Software and Affected Versions Idira Privileged Session Manager for SSH PSMP versions prior to 15.0.2 Idira Privileged Session Manager for SSH PSMP versions prior to 14.6.3 Idira Privileged Session Manager for SSH PSMP versions prior to 14.2.5 Idira Privileged Session Manag...

Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected...

CVE-2026-43828

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected...

SUSE CVE-2026-7818

Deserialization of untrusted data CWE-502 in pgAdmin 4 FileBackedSessionManager. The session manager performed unsafe deserialization of session-file contents using Python's standard object-serialization module before performing any HMAC integrity check. Any file dropped into the sessions directo...

de.javakaffee.msm:memcached-session-manager (>=1.8.0, <=1.8.1), de.javakaffee.msm:memcached-session-manager-tc7 (>=1.7.0, <=1.8.1) +8 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (7.0.40)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.javakaffee.msm:memcached-session-manager =1.8.0, =1.7.0, =2.4, =2.5.3 Source cves:...

de.javakaffee.msm:memcached-session-manager-tc8 (>=1.8.2, <=1.9.0-rc1), org.apache.tomcat:tomcat-catalina-ha (8.0.5) +3 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (8.0.5)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.javakaffee.msm:memcached-session-manager-tc8 =1.8.2, =0.7, =0.15 Source cves: CVE-2026-435...

de.javakaffee.msm:memcached-session-manager-tc8 (>=1.8.0, <=1.8.1), org.apache.tomcat:tomcat-catalina-ha (8.0.0-rc10) +2 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (8.0.0-rc10)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.0-rc10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.javakaffee.msm:memcached-session-manager-tc8 =1.8.0, =1.8.1 -...

de.javakaffee.msm:memcached-session-manager-tc8 (>=1.8.0, <=1.8.1), org.apache.tomcat:tomcat-catalina-ha (8.0.0-rc10) +2 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (8.0.0-rc10)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.0-rc10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.javakaffee.msm:memcached-session-manager-tc8 =1.8.0, =1.8.1 -...

de.javakaffee.msm:memcached-session-manager-tc8 (>=1.8.2, <=1.9.0-rc1), org.apache.tomcat:tomcat-catalina-ha (8.0.5) +3 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (8.0.5)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.javakaffee.msm:memcached-session-manager-tc8 =1.8.2, =0.7, =0.15 Source cves: CVE-2026-435...

com.geetools.geemvc:geemvc (0.9.1-beta3), com.geetools.geemvc:geeticket-webapp-jpa-jsp (0.9.1-beta3) +8 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (8.0.35)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.35 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.geetools.geemvc:geemvc 0.9.1-beta3 - com.geetools.geemvc:geeticket-webapp-jpa-jsp...

de.javakaffee.msm:memcached-session-manager-tc8 (>=y, <=2.3.2), org.apache.tomcat:tomcat-catalina-ha (8.5.29) +7 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (8.5.29)

org.apache.tomcat:tomcat-catalina MAVEN version 8.5.29 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.javakaffee.msm:memcached-session-manager-tc8 =y, =3.5.0, =3.5.0, =3.5.4 -...

de.javakaffee.msm:memcached-session-manager-tc8 (>=1.8.2, <=1.9.0-rc1), org.apache.tomcat:tomcat-catalina-ha (8.0.5) +3 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat-catalina (8.0.5)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.javakaffee.msm:memcached-session-manager-tc8 =1.8.2, =0.7, =0.15 Source cves: CVE-2026-435...

com.geetools.geemvc:geemvc (0.9.1-beta3), com.geetools.geemvc:geeticket-webapp-jpa-jsp (0.9.1-beta3) +8 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat-catalina (8.0.35)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.35 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.geetools.geemvc:geemvc 0.9.1-beta3 - com.geetools.geemvc:geeticket-webapp-jpa-jsp...

de.javakaffee.msm:memcached-session-manager (>=1.8.0, <=1.8.1), de.javakaffee.msm:memcached-session-manager-tc7 (>=1.7.0, <=1.8.1) +8 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat-catalina (7.0.40)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.javakaffee.msm:memcached-session-manager =1.8.0, =1.7.0, =2.4, =2.5.3 Source cves:...

de.javakaffee.msm:memcached-session-manager-tc8 (>=1.8.0, <=1.8.1), org.apache.tomcat:tomcat-catalina-ha (8.0.0-rc10) +2 more potentially affected by CVE-2026-43514 via org.apache.tomcat:tomcat-catalina (8.0.0-rc10)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.0-rc10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - de.javakaffee.msm:memcached-session-manager-tc8 =1.8.0, =1.8.1 -...