A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions ...

CVE-2026-44873

A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their a

历史摘要 · 未重新核验 · NVD

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sens...

CVE-2026-43911

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when t

历史摘要 · 未重新核验 · NVD

ech0's acess tokens with expiry=never cannot be revoked: logout panics, delete does not blacklist JTI

## Summary Access tokens created with the "never expire" option have no `exp` JWT claim. Three independent revocation m

历史摘要 · 未重新核验 · GitHub Advisory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-setup/{hash} endpoint accepts a 60-character random invite...

CVE-2026-41902

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.217, the /user-s

历史摘要 · 未重新核验 · NVD

Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via "cycle_session_keys()", but...

CVE-2026-41519

Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their password, browser sessions

历史摘要 · 未重新核验 · NVD

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0 to before versi...

CVE-2026-41891

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

历史摘要 · 未重新核验 · NVD

Daptin's Session Management Vulnerability Leads to Insufficient Session Expiration After Password Change

### Summary A session invalidation vulnerability exists in daptin's authentication system where JSON Web Tokens (JWTs)

历史摘要 · 未重新核验 · GitHub Advisory

katalyst-koi: Session cookies can be replayed after user logout

CVE-2026-44511

### Impact Admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid

历史摘要 · 未重新核验 · GitHub Advisory

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.lo...

CVE-2026-40934

Jupyter Server 是 Jupyter web 应用的后端组件。在版本 2.17.0 及更早版本中，用于签名认证 cookie 的秘密密钥被持久化存储到一个静态文件 `~/.local/share/jupyter/runtime/

历史摘要 · 未重新核验 · NVD

CI4MS has a Deactivated User Session Bypass (active=0)

CVE-2026-41891

### Summary The auth filter has the deactivated/banned user check commented out. ### Details CodeIgniter Shield's `log

历史摘要 · 未重新核验 · GitHub Advisory

Weblate Doesn't Invalidate API Token on Password Change

CVE-2026-41519

### Impact When a user changes their password, browser sessions are correctly invalidated via `cycle_session_keys()`, bu

历史摘要 · 未重新核验 · GitHub Advisory