A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lig...

CVE-2026-44188

A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing...

CVE-2026-53830

OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked...

CVE-2026-53824

OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to contin

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and Zalo webhook secrets to remain active after secrets.reloa...

CVE-2026-53830

OpenClaw before 2026.4.22 contains a webhook secret revocation bypass vulnerability allowing callers with old Slack and

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to continue executing commands during monitor refresh windows. Att...

CVE-2026-53824

OpenClaw before 2026.4.24 contains a token revocation vulnerability allowing callers with revoked slash tokens to contin

历史摘要 · 未重新核验 · NVD

Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain access via persist...

CVE-2026-46657

Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that a

历史摘要 · 未重新核验 · NVD

Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account ha...

CVE-2026-46656

Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions

历史摘要 · 未重新核验 · NVD

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper session termination vulnerability where authentication toke...

CVE-2026-46401

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper se

历史摘要 · 未重新核验 · NVD

NocoDB: OAuth Tokens Persist Through Security Events

### Summary OAuth access and refresh tokens were not revoked when the user changed, reset, or recovered their password,

历史摘要 · 未重新核验 · GitHub Advisory

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked logout in the UI: the logout flow for `FabAuthManager` and ...

CVE-2026-48726

A bug in Apache Airflow's auth manager logout handling left previously-issued JWT tokens valid after the user clicked lo

历史摘要 · 未重新核验 · NVD

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice mo...

CVE-2026-44648

SillyTavern is a locally installed user interface that allows users to interact with text generation large language mode

历史摘要 · 未重新核验 · NVD

NocoDB: Stale Auth Cache After API Token Deletion

CVE-2026-46554

### Summary Deleted API tokens continued to authenticate requests until their cache entry expired, because the auth cach

历史摘要 · 未重新核验 · GitHub Advisory

Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking. This issue affects Mobile App...

CVE-2026-1815

Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application

历史摘要 · 未重新核验 · NVD

eduMFA Passkeys: missing expiration flag may allow replay attacks and reuse of old challenges

### Impact In eduMFA = 2.9.1 by adding validity information to the userless challenges. ### Workarounds No known workar

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, administrative role changes and user deletions do not iterate ...

CVE-2026-44553

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, admin

历史摘要 · 未重新核验 · NVD

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a user's password did not invalidate the user's existing r...

CVE-2026-22706

Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, changing or resetting a

历史摘要 · 未重新核验 · NVD

Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user logged out. An attac...

CVE-2026-44511

Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies wer

历史摘要 · 未重新核验 · NVD

Strapi: Password Reset Does Not Revoke Existing Refresh Sessions

CVE-2026-22706

### Summary of CVE-2026-22706 Vulnerability Details - CVE: CVE-2026-22706 - CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:H/AT:N/

历史摘要 · 未重新核验 · GitHub Advisory

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host...

CVE-2026-5545

libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a

历史摘要 · 未重新核验 · NVD

SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

CVE-2026-44648

### Summary Changing a user’s password does not invalidate existing sessions, allowing an attacker with a stolen cookie

历史摘要 · 未重新核验 · GitHub Advisory