CVE-2026-107399: Exposure of Sensitive Information to an Unauthorized Actor

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agentresponsefollowmetarefresh when Mechanizefollowmetarefresh is enabled. A page containing a meta refresh to another origin causes headers...

CVE-2026-107719: Insufficient Session Expiration

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.4, the fast-jwt createVerifier cache can continue accepting a previously valid, signed JWT after its exp time when caching is enabled and the token has exp but no iat. In src/verifier.js, cacheSet derives the exp cache deadlin...

CVE-2026-107721: Insufficient Session Expiration

fast-jwt provides fast JSON Web Token JWT implementation. Prior to 6.3.0, fast-jwt createVerifier accepts Infinity for clockTolerance because its option validation checks type and negativity but not finiteness. In validateClaimDateValue, infinite positive and negative modifiers make exp and nbf...

CVE-2026-107586: Allocation of Resources Without Limits or Throttling

Uncontrolled eviction in the browser session table of the REST API in Progressive Robot hMailServer 6.2.28 through 6.3.5 allows a remote authenticated user to end other users' sessions. The table of browser sessions, shared by every account, the server administrator and support sessions, dropped...

CVE-2026-87664: Missing Authentication for Critical Function

A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.2d and 10.0.0 through 10.0.0a1. When processing local inter-process communication IPC storage callbacks, the service accepts and registers session structures including administrative role...

CVE-2026-87682: Improper Neutralization of Special Elements used in an OS Command

Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow...

UBUNTU-CVE-2026-107229

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...

PT-2026-108187

Name of the Vulnerable Software and Affected Versions TVU Networks Receiver/Transceiver devices versions prior to 7.9 Description An authentication bypass exists in the web management login endpoint 'POST /tvu/Login'. Remote unauthenticated attackers can obtain an administrative session by...

PT-2026-107768

Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow...

Linux Distros Unpatched Vulnerability : CVE-2026-107228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the...

UBUNTU-CVE-2026-92414

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

PT-2026-108213

Name of the Vulnerable Software and Affected Versions Mechanize versions prior to 2.14.1 Description When Mechanizefollow meta refresh is enabled, the library fails to apply an origin trust boundary in the Mechanize::HTTP::Agentresponse follow meta refresh function. This allows headers configured...

PT-2026-108705

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.1.0 through 2.16.1 AsyncHttpClient versions 3.0.0 through 3.0.13 Description The ThreadSafeCookieStore in the AsyncHttpClient library fails to track whether a Set-Cookie response was received via a secure transport...

UBUNTU-CVE-2026-107228

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...

Linux Distros Unpatched Vulnerability : CVE-2026-107229

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14,...

CVE-2026-107395: Missing Authorization

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, an authenticated user can misuse the legacy session export API to retrieve details for a restricted session without access to that session, as long as the containing...

Session Fixation

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Session Fixation incomplete validation of the ThreadSafeCookieStore process. An attacker can inject unauthorized cookies across trust domains...

Improper Authentication

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Improper Authentication in the CookieStore process. An attacker can gain unauthorized access to another user's session by exploiting the...

DEBIAN-CVE-2026-107229

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and default public-suffix rules, absent...

DEBIAN-CVE-2026-107228

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the enabled-by-default cookie store replaces a Cookie header explicitly supplied through setHeader or addHeader whenever the store contribut...