ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity management platform. From 3.0.0-rc.1 through 3.4.11 and fr...

CVE-2026-56665

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL is an open source identity m

历史摘要 · 未重新核验 · NVD

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Provider validation in internal/idp/providers/jwt/session.go ...

CVE-2026-56664

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's external JWT Identity Prov

历史摘要 · 未重新核验 · NVD

Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue a...

CVE-2026-28564

Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authe

历史摘要 · 未重新核验 · NVD

nebula-mesh: Host revocation is not durable - blocked/offboarded hosts can regain a valid certificate

CVE-2026-53602

## Summary Two related authorization gaps let a host that should no longer be trusted obtain a fresh, valid Nebula cert

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redis configured, Socket.IO connect, user-join, join-channels...

CVE-2026-59219

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redi

历史摘要 · 未重新核验 · NVD

Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logout

CVE-2026-59219

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0 with Redi

历史摘要 · 未重新核验 · OSV.dev

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative becau...

CVE-2026-54779

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1,

历史摘要 · 未重新核验 · NVD

CoreWCF: SAML token replay protection is inoperative

CVE-2026-54779

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1,

历史摘要 · 未重新核验 · OSV.dev

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks future OpenID login for that identity, while existing Actu...

CVE-2026-49229

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks f

历史摘要 · 未重新核验 · NVD

Actual: Disabled OpenID users keep access through existing session tokens

CVE-2026-49229

Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling a user only blocks f

历史摘要 · 未重新核验 · OSV.dev

Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows

### Am I affected? Users are affected if all of the following are true: - They configure `secondaryStorage` on `better

历史摘要 · 未重新核验 · GitHub Advisory

Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption

CVE-2026-53517

### Am I affected? Users are affected if all of the following are true: - Their project depends on `@better-auth/oauth

历史摘要 · 未重新核验 · GitHub Advisory

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked...

CVE-2026-42172

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

历史摘要 · 未重新核验 · NVD

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked inactive, existing a...

CVE-2026-43918

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/

历史摘要 · 未重新核验 · NVD

Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a K...

CVE-2026-46455

Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper Ke

历史摘要 · 未重新核验 · NVD

A vulnerability was identified in SourceCodester Online Boat Reservation System 1.0. Affected by...

CVE-2026-14725

A vulnerability was identified in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is a

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was identified in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is an unknown functionality. Such manipulation leads to sessi...

CVE-2026-14725

A vulnerability was identified in SourceCodester Online Boat Reservation System 1.0. Affected by this vulnerability is a

历史摘要 · 未重新核验 · NVD

IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the...

CVE-2025-36359

IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow

历史摘要 · 未重新核验 · NVD

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows...

CVE-2026-54479

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

历史摘要 · 未重新核验 · GitHub Advisory

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions...

CVE-2025-71335

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens aft

历史摘要 · 未重新核验 · GitHub Advisory