CVE-2026-55682 | High | 8.1 | 2026-10-14 | WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSES… |
CVE-2026-107421 | High | 7.3 | 2026-10-14 | Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Bro… |
CVE-2026-93909 | Critical | 9.1 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabl… |
CVE-2026-63161 | High | 8.8 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a kn… |
CVE-2024-34324 | Critical | 9.1 | 2026-10-13 | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP… |
CVE-2026-107226 | Medium | 6.8 | 2026-10-12 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14… |
CVE-2026-107229 | Medium | 4.0 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14… |
CVE-2026-92414 | Critical | 9.1 | 2026-10-07 | : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit.
Jackrabbit WebDAV server attaches a cached authenticated session on any… |
CVE-2026-105233 | Medium | 6.3 | 2026-10-05 | A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Thi… |
CVE-2026-104469 | Medium | 6.8 | 2026-10-02 | YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP… |
CVE-2026-102489 | Critical | 9.8 | 2026-09-30 | Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in… |
CVE-2026-71302 | High | 7.1 | 2026-09-29 | The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a s… |
CVE-2026-101268 | | | 2026-09-29 | If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not not… |
CVE-2026-92609 | Critical | 9.8 | 2026-09-25 | Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via reuse of a se… |
CVE-2026-57179 | Medium | 4.2 | 2026-09-24 | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as… |
CVE-2026-95828 | Medium | 4.3 | 2026-09-22 | A vulnerability was determined in Mstfakts College-Management-System. This affects the function session_start of the file Front-end/server.php of the component… |
CVE-2026-79312 | Medium | 6.8 | 2026-09-22 | webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session fro… |
CVE-2026-61687 | High | 7.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state… |
CVE-2026-82355 | Medium | 4.2 | 2026-09-21 | When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the caller from the cookie… |
CVE-2026-81181 | Low | 3.7 | 2026-09-18 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the… |
CVE-2026-86688 | | | 2026-09-17 | Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browser to hold an authen… |
CVE-2026-92984 | High | 8.1 | 2026-09-17 | HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to… |
CVE-2026-77614 | High | 8.8 | 2026-09-17 | Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default securit… |
CVE-2026-78428 | High | 8.0 | 2026-09-17 | For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticated session when mu… |
CVE-2026-61592 | High | 7.4 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed… |
CVE-2026-69214 | Medium | 6.8 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute with… |
CVE-2026-1758 | High | 8.3 | 2026-09-15 | Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation.
This issue affects GateManager: 11.5;0, 11.4.625515072:0.
… |
CVE-2026-64857 | | | 2026-09-09 | tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and es… |
CVE-2026-86674 | Medium | 6.3 | 2026-09-08 | A vulnerability was found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is the functio… |
CVE-2026-76196 | High | 7.4 | 2026-09-08 | Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to ga… |
CVE-2026-86279 | Medium | 6.3 | 2026-09-07 | A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of… |
CVE-2026-75171 | Critical | 9.8 | 2026-09-04 | An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component. |
CVE-2026-85238 | Medium | 6.8 | 2026-09-03 | MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully authenticated throu… |
CVE-2026-84652 | High | 7.3 | 2026-09-02 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing… |
CVE-2026-18527 | Critical | 9.9 | 2026-08-28 | IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by A… |
CVE-2026-81826 | | | 2026-08-27 | Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed.
This means that if an attacker already posses… |
CVE-2026-70594 | Medium | 6.7 | 2026-08-04 | Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for s… |
CVE-2026-69245 | Medium | 6.5 | 2026-08-03 | Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetC… |
CVE-2026-16496 | High | 8.9 | 2026-07-28 | The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who… |
CVE-2021-32088 | Critical | 9.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-fo… |
CVE-2026-16089 | Medium | 5.4 | 2026-07-17 | A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound… |
CVE-2026-59883 | Medium | 4.7 | 2026-07-08 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact ho… |
CVE-2026-14609 | Medium | 5.6 | 2026-07-03 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This issue affects some unknown processing. The m… |
CVE-2026-13707 | High | 7.6 | 2026-07-01 | Session fixation vulnerability in Wikimedia Foundation OAuth.
This vulnerability is associated with program files src/Backend/MWOAuthServer.Php.
This issu… |
CVE-2026-56224 | Medium | 5.4 | 2026-06-30 | Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confir… |
CVE-2026-35095 | | | 2026-06-30 | KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a cookie with a valid name is set, its value remains unchang… |
CVE-2026-40082 | Medium | 5.4 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after login, leading to Sess… |
CVE-2026-56425 | High | 8.8 | 2026-06-22 | The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to… |
CVE-2026-12581 | High | 7.5 | 2026-06-22 | EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can… |
CVE-2026-53900 | Medium | 4.3 | 2026-06-16 | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject a… |
CVE-2009-10007 | Critical | 9.1 | 2026-06-09 | Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks.
Catalyst::Plugin::Authentication does not autom… |
CVE-2026-41839 | Medium | 4.2 | 2026-06-09 | A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a… |
CVE-2026-11335 | Medium | 6.3 | 2026-06-05 | A flaw has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. This impacts… |
CVE-2025-67446 | Critical | 9.8 | 2026-06-04 | Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router uses a weak/predictable cookie value for… |
CVE-2026-33384 | | | 2026-05-29 | QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour e… |
CVE-2026-48545 | Medium | 6.8 | 2026-05-27 | Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a sha… |
CVE-2026-43827 | Medium | 6.5 | 2026-05-25 | Default configurations of Apache Shiro have a session fixation vulnerability.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are… |
CVE-2026-45773 | Medium | 6.5 | 2026-05-15 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did… |
CVE-2026-41613 | High | 8.8 | 2026-05-12 | Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-30808 | High | 8.1 | 2026-05-12 | Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800 |
CVE-2025-65415 | Medium | 5.4 | 2026-05-11 | docuFORM Managed Print Service Client 11.11c is vulnerable to a session fixation attack via the login page of the application. |
CVE-2026-40010 | Critical | 9.1 | 2026-05-06 | Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.
T… |
CVE-2025-46605 | Medium | 6.2 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain a session fixation vulnerability. A… |
CVE-2026-34454 | Low | 3.5 | 2026-04-14 | OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the… |
CVE-2026-31940 | High | 7.5 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to… |
CVE-2026-33946 | Medium | 5.9 | 2026-03-27 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb imple… |
CVE-2026-33757 | Critical | 9.6 | 2026-03-27 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via J… |
CVE-2026-25101 | Critical | 9.8 | 2026-03-27 | Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enable… |
CVE-2025-55266 | Medium | 5.9 | 2026-03-26 | HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized transaction behalf o… |
CVE-2026-33492 | High | 7.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function accepts arbitrary session IDs via the… |
CVE-2025-70973 | Medium | 4.8 | 2026-03-09 | ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the sess… |
CVE-2026-30224 | Medium | 5.4 | 2026-03-06 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user… |
CVE-2026-24352 | Critical | 9.8 | 2026-02-27 | PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour… |
CVE-2025-71057 | High | 8.2 | 2026-02-26 | Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing th… |
CVE-2026-24894 | High | 7.5 | 2026-02-12 | FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset be… |
CVE-2026-2177 | High | 7.3 | 2026-02-08 | A vulnerability has been found in SourceCodester Prison Management System 1.0. The impacted element is an unknown function of the component Login. The manipula… |
CVE-2026-23796 | Critical | 9.8 | 2026-02-05 | Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour… |
CVE-2026-23624 | Medium | 4.3 | 2026-02-04 | GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used… |
CVE-2025-7014 | Medium | 5.7 | 2026-01-29 | Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking.
This issue affects Menu Panel: through 29012026.
NOTE… |
CVE-2025-7015 | Medium | 5.7 | 2026-01-29 | Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation.
This issue affects QR Menu: be… |
CVE-2025-69602 | Critical | 9.1 | 2026-01-28 | A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful a… |
CVE-2025-68139 | Medium | 4.3 | 2026-01-21 | EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminate_connection_on_failed_response` is `Fa… |
CVE-2025-36115 | Medium | 6.3 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0.00 through 5.2.0.12 does not disallow the session id after use which could allow an auth… |
CVE-2026-22082 | | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credentials as the session… |
CVE-2020-36913 | Medium | 5.3 | 2026-01-06 | All-Dynamics Software enlogic:show 2.0.2 contains a session fixation vulnerability that allows attackers to set a predefined PHP session identifier during the… |
CVE-2025-43516 | Low | 3.3 | 2025-12-12 | A session management issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. A user with… |
CVE-2023-53776 | High | 8.8 | 2025-12-10 | Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to exploit weak session management by reusing IP-bound session ident… |
CVE-2023-53775 | Medium | 6.5 | 2025-12-10 | Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change user passwords by exploiting weak session management contr… |
CVE-2023-53741 | High | 8.1 | 2025-12-10 | Screen SFT DAB 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP address-bound sessi… |
CVE-2025-63529 | Medium | 6.1 | 2025-12-01 | A session fixation vulnerability exists in Blood Bank Management System 1.0 in login.php that allows an attacker to set or predict a user's session identifier… |
CVE-2025-65681 | Low | 3.3 | 2025-11-26 | An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information… |
CVE-2025-56400 | High | 8.8 | 2025-11-24 | Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mob… |
CVE-2025-63224 | Critical | 10.0 | 2025-11-19 | The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JW… |
CVE-2025-63216 | Critical | 10.0 | 2025-11-18 | The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid J… |
CVE-2025-37159 | Medium | 5.8 | 2025-11-18 | A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active u… |
CVE-2025-64100 | Medium | 6.1 | 2025-10-29 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attac… |
CVE-2025-12390 | Medium | 6.0 | 2025-10-28 | A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happ… |
CVE-2025-56746 | Low | 2.2 | 2025-10-15 | Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attac… |
CVE-2025-10228 | High | 8.8 | 2025-10-14 | Session Fixation vulnerability in Rolantis Information Technologies Agentis allows Session Hijacking.
This issue affects Agentis: before 4.44. |
CVE-2025-59841 | Critical | 9.8 | 2025-09-25 | Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation… |