AZL-105185 CVE-2026-94419 affecting package mariadb 10.11.19-1

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

UBUNTU-CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419 Client session cache reference poisoning allows resumption with wrong server

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

EUVD-2026-87906

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-94419 Client session cache reference poisoning allows resumption with wrong server

Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the process-global SessionCache, and ClientSessionToSession validates it against that hash alone. Because the TLS 1.2 session ID is chosen by the...

CVE-2026-100862

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100725

http4k Maven artifact org.http4k:http4k-core before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage client-side cookie store used by ClientFilters.Cookies that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage...

CVE-2026-100862

The workflow automation platform heym versions prior to 0.0.91 contains multiple plaintext storage vulnerabilities. The application fails to encrypt several sensitive secrets, including webhook header-auth values , MCP API keys , portal session tokens , workflow execution JWTs , and Discord inter...

CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

EUVD-2026-87827

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100725 http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

http4k Maven artifact org.http4k:http4k-core before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage client-side cookie store used by ClientFilters.Cookies that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage...

CVE-2026-100725 http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

http4k Maven artifact org.http4k:http4k-core before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage client-side cookie store used by ClientFilters.Cookies that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage...

CVE-2026-100725 http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

http4k Maven artifact org.http4k:http4k-core before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage client-side cookie store used by ClientFilters.Cookies that does not enforce RFC 6265 scoping rules for the cookie domain, path, and Secure attributes. When a single BasicCookieStorage...

CVE-2026-100862: Cleartext Storage of Sensitive Information

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

PT-2026-99517

Name of the Vulnerable Software and Affected Versions wolfSSL versions 5.3.0 through 5.9.2 Description When NO SESSION CACHE REF is undefined, the wolfSSL get session function returns a ClientSession reference to the process-global SessionCache instead of a session object. The...