Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE

A critical security flaw impacting Rejetto HTTP File Server HFS is witnessing active exploitation attempts, according to VulnCheck. The vulnerability in question is CVE-2026-61500 CVSS score: 9.3, a case of session forgery stemming from the use of a weak pseudo-random number generator PRNG that c...

CVE-2026-72887

A flaw was found in Net::OAuth::Client. A malicious service provider can silently downgrade an OAuth 1.0a connection to OAuth 1.0 by omitting the oauthcallbackconfirmed parameter in the request token response. This downgrade vulnerability removes the oauthverifier binding, making the application...

CVE-2026-105302

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105233

A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to...

CVE-2026-105302

A flaw in the User Session Note mapper of the Keycloak identity and access management solution allows for the exposure of sensitive internal credentials. The mapper fails to validate if a requested session note contains federated access tokens from external identity providers. Consequently, a del...

CVE-2026-105302 Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105302 Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

EUVD-2026-92257

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105233 kishor-23 food-waste-management-system Login Flow login.php session fixiation

A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to...

CVE-2026-105233 kishor-23 food-waste-management-system Login Flow login.php session fixiation

A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to...

CVE-2026-105233 kishor-23 food-waste-management-system Login Flow login.php session fixiation

A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to...

CVE-2026-105233

A session fixation vulnerability exists in the Login Flow component of the kishor-23 food-waste-management-system (specifically within the login.php file). The root cause involves the manipulation of the PHPSESSID argument, which allows for remote exploitation. While the exploit has been disclose...

EUVD-2026-92256

A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to...

CVE-2026-105302

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU

A flaw was found in FreeRDP. This vulnerability allows a remote attacker with low privileges to disclose sensitive information from the server or proxy process memory to a downstream client. This occurs because certain functions responsible for writing Save Session Info Protocol Data Units PDUs u...

Termix-research

Termix Security Research Vulnerability research on Termix, a web-based SSH and server management platform 13k+ stars. CVE| Issue| Severity| Fixed| Advisory ---|---|---|---|--- CVE-2026-45746| Session hijacking → RCE| 9.0 Critical| v2.3.2| GHSA-cx2r-843c-vww8 CVE-2026-45750| OS command injection|...

CVE-2026-105306: Missing Authorization

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105302: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-102295: Improper Neutralization of Input During Web Page Generation

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

CVE-2026-105643: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the pos...