Lucene search
+L

4390 matches found

SUSE CVE
SUSE CVE
added 2026/03/29 12:29 a.m.13 views

SUSE CVE-2025-59028

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes hea...

5.3CVSS5.9AI score0.00447EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/03/29 12:00 a.m.21 views

PT-2026-28613

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.64 Parse Server versions prior to 9.7.0-alpha.8 Description Parse Server is an open source backend deployable on Node.js infrastructure. An attacker with a valid authentication provider token and a single MFA...

4.4CVSS5.9AI score0.00311EPSS
SaveExploits0References12
OSV
OSV
added 2026/03/27 10:28 p.m.13 views

GHSA-9P93-7J67-5PC2 OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding

Summary Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding. Details The HTTP route previously treated any bearer-authenticated request as admin-eligible and could call without binding the action to requester ownership or caller-granted operator scopes. Th...

7.1CVSS6AI score0.00346EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/03/27 10:28 p.m.11 views

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the sessions/:sessionKey/kill HTTP route. An attacker can terminate arbitrary sessions without proper authorization by sending a bearer-authenticated request th...

8.1CVSS6AI score0.00346EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/03/27 5:09 p.m.14 views

CVE-2026-26073

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible std::queue/std::deque corruption. The trigger is powermeter public key update and EV session/error events while OCPP not started. This results in a TSAN data race report and an ASAN/UBSAN...

5.9CVSS5.9AI score0.00304EPSS
SaveExploits0References1
OSV
OSV
added 2026/03/27 9:16 a.m.20 views

AZL-81686 CVE-2025-59028 affecting package dovecot 2.3.20-1

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes hea...

7.5CVSS5.9AI score0.00447EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/03/27 8:10 a.m.8 views

CVE-2025-59028

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes hea...

5.3CVSS5.9AI score0.00447EPSS
SaveExploits0References1
AlpineLinux
AlpineLinux
added 2026/03/27 8:10 a.m.38 views

CVE-2025-59028

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes hea...

7.5CVSS5.9AI score0.00447EPSS
SaveExploits0References1
Amazon
Amazon
added 2026/03/27 12:00 a.m.31 views

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: tls: Use skdstget and dstdevrcu in getnetdevforsock. CVE-2025-40149 In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix out of range indexing in namesize CVE-2025-68792 In the...

7.8CVSS6.2AI score0.00411EPSS
SaveExploits0
OSV
OSV
added 2026/03/27 12:00 a.m.18 views

UBUNTU-CVE-2025-59028

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes hea...

7.5CVSS5.8AI score0.00447EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve
added 2026/03/27 12:00 a.m.19 views

CVE-2025-59028

When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fail. Invalid BASE64 data can be used to DoS a vulnerable server to break concurrent logins. Install fixed version or disable concurrency in login processes hea...

7.5CVSS5.9AI score0.00447EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/26 9:44 p.m.28 views

Improper Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Authorization via the send process. An attacker can interact with unauthorized child sessions by exploiting insufficient enforcement of controlScope restrictions. Remediation...

5.4CVSS5.9AI score0.002EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/03/26 9:44 p.m.16 views

OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions

Summary Leaf subagents could still use the send action to message controlled child sessions even when their controlScope was narrower than children. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...

5.3CVSS5.8AI score0.002EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2026/03/26 9:44 p.m.5 views

GHSA-X2CM-HG9C-MF5W OpenClaw leaf subagents can bypass controlScope restrictions to send messages to child sessions

Summary Leaf subagents could still use the send action to message controlled child sessions even when their controlScope was narrower than children. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked: v2026.3.23-2...

5.3CVSS5.9AI score0.002EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE
added 2026/03/26 3:17 p.m.9 views

CVE-2026-32362

Missing Authorization vulnerability in activity-log.com WP Sessions Time Monitoring Full Automatic activitytime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Sessions Time Monitoring Full Automatic: from n/a through = 1.1.3...

5.3CVSS5.8AI score0.00224EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/03/26 3:10 p.m.13 views

CVE-2026-32713

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc2, A logic error in the PX4 Autopilot MAVLink FTP session validation uses incorrect boolean logic && instead of ||, allowing BurstReadFile and WriteFile operations to proceed with invalid sessions or closed file descriptors...

6.5CVSS5.8AI score0.00387EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/03/26 3:09 p.m.13 views

CVE-2026-27649

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

7.3CVSS5.8AI score0.00328EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/03/26 3:05 p.m.15 views

CVE-2025-41258

LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API...

8CVSS5.8AI score0.00344EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/03/26 3:04 p.m.12 views

CVE-2025-64998

Exposure of session signing secret in Checkmk 2.4.0p23, 2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hijack sessions on the central site by forging session cookies...

7.3CVSS5.8AI score0.00334EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/03/26 3:03 p.m.14 views

CVE-2026-32048

OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessionsspawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session can exploit this to spawn child runtimes with sandbox.mode set ...

9.9CVSS5.8AI score0.00281EPSS
SaveExploits0References1
Rows per page
Query Builder