Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- UnknownApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement tokenOct 15, 2026
- Medium6.8FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.EPSS 0.2%Oct 14, 2026
- High7.5Insufficient Session Expiration vulnerability in Progress MOVEit Transfer.EPSS 0.3%Oct 14, 2026
- High8.6Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist.Oct 13, 2026
- Medium5.4When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the request…EPSS 0.2%Oct 13, 2026
- Medium5.3Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution TokensEPSS 0.2%Oct 12, 2026
- Critical9.1Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed.Oct 12, 2026
- Critical9.1The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity.Oct 9, 2026
- UnknownRevoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication PhoenixSep 17, 2026
- Critical9.6Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay).May 22, 2026
- Medium5.7Insufficient session expiration vulnerability in Turkiye Electricity Transmission Corporation (TEİAŞ) Mobile Application allows Session Hijacking.EPSS 0.2%May 21, 2026
- High8.1Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.May 15, 2026
- Low2.1Strapi is an open source headless content management system.EPSS 0.3%May 14, 2026
- High7.4Katalyst Koi is a framework for building Rails admin functionality.May 14, 2026
- Medium6.5libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.May 13, 2026
- Medium5.4A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled.May 12, 2026
- High8.5Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services.May 12, 2026
- High8.1Vaultwarden is a Bitwarden-compatible server written in Rust.May 11, 2026
- Critical9.1FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.May 7, 2026
- Medium5.4Weblate is a web based localization tool.May 7, 2026
- Medium5.3CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.May 7, 2026
- High7.6Jupyter Server is the backend for Jupyter web applications.May 5, 2026
- Low2.3OpenClaw before 2026.4.8 contains a session management vulnerability where existing WebSocket sessions survive shared gateway token rotation.Apr 28, 2026
- Low2.3OpenClaw before 2026.4.8 contains an authentication state management vulnerability where the resolvedAuth closure becomes stale after configuration reload.Apr 28, 2026
- Medium6.9A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for…Apr 24, 2026
80 records · page 1 of 4
PreviousNext