EUVD-2026-101014

Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2...

CVE-2026-107421 WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability

Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2...

CVE-2026-107421

The VideoWhisper.com Broadcast Live Video (videowhisper-live-streaming-integration) WordPress plugin, versions up to and including 7.3.2 , is susceptible to a Session Fixation vulnerability (CWE-384). This flaw allows an attacker to perform Session Hijacking , potentially gaining unauthorized acc...

curl: curl: FTP connection reuse inherits client-certificate

A flaw was found in curl that can allow unauthorized access through improper session reuse. When an unencrypted File Transfer Protocol FTP transfer reuses a pooled connection previously authenticated with a client certificate and upgraded using Transport Layer Security TLS, curl fails to perform ...

BIT-GITEA-2026-96404 Gitea installer authentication bypass for existing accounts

When Gitea's web installer is reachable against a database that already contains users, such as after INSTALLLOCK has been reset to false, submitting the install form with an administrator username matching an existing account issued an authenticated session for that account without verifying its...

BIT-GITEA-2026-73278 Gitea WebAuthn bypass during OAuth and OIDC sign-in

Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able to authenticate through the affected external identity flow can obtain a full session without the passkey verification enforced during...

CURL-CVE-2026-87864 IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

CVE-2026-94260

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting...

CVE-2019-5420

CVE-2019-5420 Ruby-on-Rails offers three different environments it can run in: development, test and production. You should obviously not have code running in development or test available on the internet but it as always happens for example in staging environments. Ruby-on-Rails uses...

CVE-2026-107594

The File Upload to Order WordPress plugin, prior to version 1.1.4 , is vulnerable to unauthenticated arbitrary file deletion . The flaw occurs because the plugin fails to validate or confine a file path derived from attacker-controlled session data before performing a deletion action. Since this ...

UBUNTU-CVE-2026-87864

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only N bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within th...

CVE-2026-84471: Use After Free

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

Linux Distros Unpatched Vulnerability : CVE-2026-107612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process...

CVE-2026-57493: Insufficient Session Expiration

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A us...

Keycloak SSO Unauthorized Access

The vulnerability of the Single Sign-On SSO authentication mechanism of the Keycloak software for managing identity verification and access control is related to the fixation of the session at the final authorization points. Exploiting this vulnerability could allow a malicious actor to gain...

Linux Distros Unpatched Vulnerability : CVE-2026-86845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type...

Linux Distros Unpatched Vulnerability : CVE-2026-98420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another...

Ubuntu: USN-8852-1 (CVE-2026-84471): OpenVPN vulnerabilities

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

PT-2026-114152

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes...

PT-2026-113981

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 18.0 through 27.3.4.18 Erlang/OTP versions 28.0 through 28.5.0.7 Erlang/OTP versions 29.0 through 29.1.1 ssl versions 7.0 through 11.2.12.13 ssl versions 11.6.0 through 11.6.0.6 ssl versions 11.7.0 through 11.7.7 Descriptio...