IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

CVE-2025-36069

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an auth

历史摘要 · 未重新核验 · NVD

Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows...

CVE-2026-111917

Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket

历史摘要 · 未重新核验 · GitHub Advisory

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows...

CVE-2026-111919

Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to ke

历史摘要 · 未重新核验 · GitHub Advisory

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated...

CVE-2025-71435

Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access

历史摘要 · 未重新核验 · GitHub Advisory

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route...

CVE-2026-96806

The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token

历史摘要 · 未重新核验 · GitHub Advisory

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked adm...

CVE-2026-74037

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token

历史摘要 · 未重新核验 · NVD

Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token

CVE-2026-74037

Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token

历史摘要 · 未重新核验 · OSV.dev

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTo...

CVE-2026-84321

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-t

历史摘要 · 未重新核验 · NVD

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execu...

CVE-2026-109362

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep exec

历史摘要 · 未重新核验 · NVD

The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to keep API access, because SessionAuthen...

CVE-2026-109320

The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows di

历史摘要 · 未重新核验 · NVD

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open te...

CVE-2026-109289

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to ke

历史摘要 · 未重新核验 · NVD

Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens

CVE-2026-109362

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep exec

历史摘要 · 未重新核验 · OSV.dev

Grav API Plugin before 1.0.36 Disabled Account Session Access Bypass

CVE-2026-109320

The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows di

历史摘要 · 未重新核验 · OSV.dev

Open WebUI 0.8.8 before 0.11.4 Improper Session Revocation via Terminal WebSocket

CVE-2026-109289

Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to ke

历史摘要 · 未重新核验 · OSV.dev

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed. As a result, an ex...

CVE-2026-78357

Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is d

历史摘要 · 未重新核验 · NVD

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connec...

CVE-2026-108809

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processin

历史摘要 · 未重新核验 · NVD

A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config/add of the component Disable API. Th...

CVE-2026-108803

A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the

历史摘要 · 未重新核验 · NVD

A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function...

CVE-2026-108785

A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of t

历史摘要 · 未重新核验 · GitHub Advisory

A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refreshToken of the component JwtAuthentic...

CVE-2026-108785

A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of t

历史摘要 · 未重新核验 · NVD

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

## Summary A collaborator removed from a project keeps a **live, automatic feed** of that project's contents, because n

历史摘要 · 未重新核验 · GitHub Advisory