共收录 231 条相关情报。
← 返回所有主题CVE-2026-86698
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization me
CVE-2026-79313
webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on perio
CVE-2026-79317
A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and aut
CVE-2026-92976
A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. A
CVE-2026-86533
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a r
CVE-2026-81637
Insufficient Session Expiration vulnerability in team-alembic AshAuthentication allows an attacker who obtains a victim'
CVE-2026-92920
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain a
CVE-2026-92800
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent document
CVE-2026-85387
Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the sta
CVE-2026-82310
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation
CVE-2026-86462
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate t
CVE-2026-82311
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions,
CVE-2026-82310
Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation
CVE-2026-86462
Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate t
CVE-2026-82311
Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions,
CVE-2026-92358
A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a diff
CVE-2026-55617
Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic
CVE-2026-88262
Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick
CVE-2026-56665
### Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider (IdP)
CVE-2026-81268
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive