CVE-2026-98420: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with...

Ubuntu: USN-8852-1 (CVE-2026-84471): OpenVPN vulnerabilities

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry...

PT-2026-113981

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 18.0 through 27.3.4.18 Erlang/OTP versions 28.0 through 28.5.0.7 Erlang/OTP versions 29.0 through 29.1.1 ssl versions 7.0 through 11.2.12.13 ssl versions 11.6.0 through 11.6.0.6 ssl versions 11.7.0 through 11.7.7 Descriptio...

PT-2026-114364

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description When configured with ssl session cache shared:name:size without explicit ssl session ticket key file directives for automatic rotation of...

PT-2026-113969

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.23.0 Description FileRise fails to record when a Time-based One-Time Password TOTP code has already been successfully used for a specific account and time step. An attacker possessing valid primary credentials and ...

CVE-2026-57489: Authentication Bypass by Spoofing

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...

CVE-2026-97629: Use of Uninitialized Resource

Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-determinist...

PT-2026-114221

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.6 Description The auto-prepended 'web/html/seguranca/sessionStart.php' reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB HOST as the cookie domain. This allows an attacker to hijack...

CVE-2026-89073: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-114141

Name of the Vulnerable Software and Affected Versions sgl-project SGLang versions prior to 0.5.20 Description A remote denial of service can be triggered through the manipulation of the session params argument within the generate endpoint, specifically affecting the functionality in the file...

PT-2026-114224

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.16.0 Description Deployments with AUTH BYPASS enabled trust the configured reverse-proxy identity header without verifying if the request originated from FR TRUSTED PROXIES. If the backend application port is...

PT-2026-114411

A security vulnerability has been detected in sgl-project SGLang up to 0.5.19. Affected by this issue is the function Session.create req of the file python/sglang/srt/session/session controller.py of the component Session Cleanup. Such manipulation leads to denial of service. The attack may be...

CVE-2026-109527: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-105236: Improper Certificate Validation

Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one SNI virtual host to authenticate to a second SNI virtual host on the same listener by resuming its TLS 1.2 session there. A server that serves several SNI nam...

Keycloak SSO Unauthorized Access

The vulnerability of the Single Sign-On SSO authentication mechanism of the Keycloak software for managing identity verification and access control is related to the fixation of the session at the final authorization points. Exploiting this vulnerability could allow a malicious actor to gain...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130098)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130098 advisory. Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41,...

Linux Distros Unpatched Vulnerability : CVE-2026-97629

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:name:size without an explicit sslsessionticketkey file directives to...

Linux Distros Unpatched Vulnerability : CVE-2026-98420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another...

Linux Distros Unpatched Vulnerability : CVE-2026-86845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type...

Linux Distros Unpatched Vulnerability : CVE-2026-107612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process...