CVE-2025-62342 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management IEM is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion...

CVE-2026-47841 WebAuthn User Verification Bypass via Session Serialization

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18...

DEBIAN-CVE-2026-79129

Use after free in Sessions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: Medium...

CVE-2026-79129

Use after free in Sessions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: Medium...

CVE-2026-79129

Use after free in Sessions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: Medium...

CVE-2026-79129

Use after free in Sessions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: Medium...

CVE-2026-79129

CVE-2026-79129 is a use-after-free vulnerability in the Sessions component of Google Chrome on Android , affecting versions prior to 152.0.7977.65 . A remote attacker leveraging social engineering can achieve arbitrary code execution outside the sandbox via UI interaction. The CNA-assigned CVSS 3...

EUVD-2026-42720

@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key...

GHSA-WV94-5QCP-6M36 PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)

Summary The PraisonAI MCP HTTP-stream server creates a new in-memory session on every initialize request and never removes it. The cleanup routine that would expire sessions cleanupsessions is defined but never called anywhere in the codebase, and the configured session TTL is never enforced. The...

CVE-2026-55531 PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the MCP HTTP Stream mcppost handler creates a new sessions entry for every initialize request but does not call cleanupsessions or enforce a maximum. An unauthenticated caller can exhaust memory. The fix invokes cleanup and limit...

PT-2026-81322

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The MCP HTTP Stream mcp post handler fails to enforce a maximum number of sessions and does not invoke the cleanup sessions function to expire old entries. Consequently, every initialize request...

PT-2026-81709

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description A use after free issue exists in Sessions, which allows a remote attacker to execute arbitrary code outside the sandbox through UI interaction and social engineering. Use aft...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: cifs: A use-after-free bug has been fixed in refreshcacheworker. The UAF bug occurred because we were putting DFS root sessions into cifsumount while the DFS cache refresher was executing. We have ensured that DFS root session...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: Client: Fixed a potential Use-after-Free UAF in isvalidoplockbreak. Skipped sessions that are being torn down status == SESEXITING to avoid UAF...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: -misc: fastrpc: fix memory corruption on probe A missing sanity check has been added to the count of probed sessions, to prevent memory corruption beyond the fixed-size slab-alocated session array when there are more than...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: fixed a potential Use-after-Allocation error in cifssignalcifsdforreconnect. Skipped sessions that are being terminated status == SESEXITING to avoid UAF Use-after-Allocation errors...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: Client: Fixed a potential Use-after-Free UAF in smb2isvalidoplockbreak. Skipped sessions that are being torn down status == SESEXITING to avoid UAF...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: Client: Fixed a potential Use-after-Free UAF in smb2isnetworknamedeleted. Skipped sessions that are being terminated status == SESEXITING to avoid UAF...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: Fixed a potential Use-after-Allocation UAF in cifsstatsprocwrite. Skipped sessions that are being terminated status == SESEXITING to avoid UAF...

Astra Linux – Vulnerability in Firefox and Thunderbird

When checking whether the Browsing Context was discarded in HttpBaseChannel, if the load group was not available, it was assumed that the Browsing Context had already been discarded. However, this assumption was not always true for private channels after the private session ended. This...