CVE-2026-68956 SSH daemon allocates unbounded idle session channels, bypassing max_channels

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of sshconnection:handlemsg/4 checks only...

OpenPLC Runtime v3

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to hijack session cookies and issue state-changing requests as an operator which would allow the attacker to control the programmable logic controller and the physical processes it drives. 2. RECOMMENDED...

CVE-2026-76974 Information Disclosure vulnerability in SAP Fiori Launchpad

SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrat...

CVE-2026-76974 Information Disclosure vulnerability in SAP Fiori Launchpad

SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrat...

CVE-2026-76974

CVE-2026-76974 affects SAP Fiori Launchpad , where insufficient validation of certain user-controlled input allows an unauthenticated attacker to craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location . ...

EUVD-2026-84489

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load reads sessionid directly from the request cookie and loads that session from the store, and save writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated sta...

CVE-2026-86698: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generaterefreshtoken/4 in...

CVE-2026-95828: Session Fixation

A vulnerability was determined in Mstfakts College-Management-System. This affects the function sessionstart of the file Front-end/server.php of the component Authentication. Executing a manipulation can lead to session fixiation. It is possible to launch the attack remotely. The exploit has been...

PT-2026-97108

Name of the Vulnerable Software and Affected Versions Mstfakts College-Management-System affected versions not specified Description A flaw in the Authentication component allows for remote session fixation. This occurs within the session start function located in the Front-end/server.php file...

ROS-20260922-73-0054

The vulnerability in Tomcat10 is related to incorrect session duration. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-79312: Session Fixation

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load reads sessionid directly from the request cookie and loads that session from the store, and save writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated sta...

CVE-2026-95665: Improper Neutralization of Input During Web Page Generation

MISP contains a reflected cross-site scripting XSS vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's...

CVE-2026-68956: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of sshconnection:handlemsg/4 checks only...

PT-2026-96709

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.14.0 through 0.16.1 Description Improper validation of the specified quantity in the input allows a client with an open payment channel to obtain paid resources without being charged. The function accept voucher/3 in...

CVE-2026-79312

webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load reads sessionid directly from the request cookie and loads that session from the store, and save writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated sta...

CVE-2026-79313

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can...

PT-2026-96721

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description A reflected cross-site scripting XSS issue exists in the AnalystDataController::viewForObject action. The method accepts a parent object type parameter from the URL without validation and passes it to...

PT-2026-96756

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can...

PT-2026-96723

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A reflected cross-site scripting XSS issue exists in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a...

PT-2026-96736

Name of the Vulnerable Software and Affected Versions MISP affected versions not specified Description A stored cross-site scripting XSS issue exists in the admin email composition screen. The organization name setting is interpolated directly into a JavaScript string literal using an unescaped P...