CVE-2026-70594 | Medium | 6.7 | 2026-08-04 | Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for s… |
CVE-2026-69245 | Medium | 6.5 | 2026-08-03 | Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetC… |
CVE-2026-16496 | High | 8.9 | 2026-07-28 | The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who… |
CVE-2021-32088 | Critical | 9.8 | 2026-07-27 | An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-fo… |
CVE-2026-16089 | Medium | 5.4 | 2026-07-17 | A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound… |
CVE-2026-59883 | Medium | 4.7 | 2026-07-08 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact ho… |
CVE-2026-14609 | Medium | 5.6 | 2026-07-03 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This issue affects some unknown processing. The m… |
CVE-2026-13707 | High | 7.6 | 2026-07-01 | Session fixation vulnerability in Wikimedia Foundation OAuth.
This vulnerability is associated with program files src/Backend/MWOAuthServer.Php.
This issu… |
CVE-2026-56224 | Medium | 5.4 | 2026-06-30 | Capgo console.capgo.app/login before 12.128.2 accepts access_token and refresh_token in URL query parameters, automatically authenticating users without confir… |
CVE-2026-35095 | | | 2026-06-30 | KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a cookie with a valid name is set, its value remains unchang… |
CVE-2026-40082 | Medium | 5.4 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after login, leading to Sess… |
CVE-2026-56425 | High | 8.8 | 2026-06-22 | The Azure Active Directory (AAD) authentication implementation contained multiple weaknesses in its OAuth 2.0 authorization flow that could allow attackers to… |
CVE-2026-12581 | High | 7.5 | 2026-06-22 | EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can… |
CVE-2026-53900 | Medium | 4.3 | 2026-06-16 | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicious site to inject a… |
CVE-2009-10007 | Critical | 9.1 | 2026-06-09 | Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks.
Catalyst::Plugin::Authentication does not autom… |
CVE-2026-41839 | Medium | 4.2 | 2026-06-09 | A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a… |
CVE-2026-11335 | Medium | 6.3 | 2026-06-05 | A flaw has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. This impacts… |
CVE-2025-67446 | Critical | 9.8 | 2026-06-04 | Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router uses a weak/predictable cookie value for… |
CVE-2026-33384 | | | 2026-05-29 | QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour e… |
CVE-2026-48545 | Medium | 6.8 | 2026-05-27 | Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation by exploiting a sha… |
CVE-2026-43827 | Medium | 6.5 | 2026-05-25 | Default configurations of Apache Shiro have a session fixation vulnerability.
This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.
Users are… |
CVE-2026-45773 | Medium | 6.5 | 2026-05-15 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.14, Turborepo's self-hosted login and SSO browser flows did… |
CVE-2026-41613 | High | 8.8 | 2026-05-12 | Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-30808 | High | 8.1 | 2026-05-12 | Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800 |
CVE-2025-65415 | Medium | 5.4 | 2026-05-11 | docuFORM Managed Print Service Client 11.11c is vulnerable to a session fixation attack via the login page of the application. |
CVE-2026-40010 | Critical | 9.1 | 2026-05-06 | Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.
T… |
CVE-2025-46605 | Medium | 6.2 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain a session fixation vulnerability. A… |
CVE-2026-34454 | Low | 3.5 | 2026-04-14 | OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. A regression introduced in 7.11.0 prevents OAuth2 Proxy from clearing the… |
CVE-2026-31940 | High | 7.5 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.php, user-controlled request parameters are directly used to… |
CVE-2026-33946 | Medium | 5.9 | 2026-03-27 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb imple… |
CVE-2026-33757 | Critical | 9.6 | 2026-03-27 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via J… |
CVE-2026-25101 | Critical | 9.8 | 2026-03-27 | Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enable… |
CVE-2025-55266 | Medium | 5.9 | 2026-03-26 | HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized transaction behalf o… |
CVE-2026-33492 | High | 7.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function accepts arbitrary session IDs via the… |
CVE-2025-70973 | Medium | 4.8 | 2026-03-09 | ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the sess… |
CVE-2026-30224 | Medium | 5.4 | 2026-03-06 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user… |
CVE-2026-24352 | Critical | 9.8 | 2026-02-27 | PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour… |
CVE-2025-71057 | High | 8.2 | 2026-02-26 | Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing th… |
CVE-2026-24894 | High | 7.5 | 2026-02-12 | FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset be… |
CVE-2026-2177 | High | 7.3 | 2026-02-08 | A vulnerability has been found in SourceCodester Prison Management System 1.0. The impacted element is an unknown function of the component Login. The manipula… |
CVE-2026-23796 | Critical | 9.8 | 2026-02-05 | Quick.Cart allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour… |
CVE-2026-23624 | Medium | 4.3 | 2026-02-04 | GLPI is a free asset and IT management software package. In versions starting from 0.71 to before 10.0.23 and before 11.0.5, when remote authentication is used… |
CVE-2025-7014 | Medium | 5.7 | 2026-01-29 | Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking.
This issue affects Menu Panel: through 29012026.
NOTE… |
CVE-2025-7015 | Medium | 5.7 | 2026-01-29 | Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation.
This issue affects QR Menu: be… |
CVE-2025-69602 | Critical | 9.1 | 2026-01-28 | A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful a… |
CVE-2025-68139 | Medium | 4.3 | 2026-01-21 | EVerest is an EV charging software stack. In all versions up to and including 2025.12.1, the default value for `terminate_connection_on_failed_response` is `Fa… |
CVE-2025-36115 | Medium | 6.3 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0.00 through 5.2.0.12 does not disallow the session id after use which could allow an auth… |
CVE-2026-22082 | | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credentials as the session… |
CVE-2020-36913 | Medium | 5.3 | 2026-01-06 | All-Dynamics Software enlogic:show 2.0.2 contains a session fixation vulnerability that allows attackers to set a predefined PHP session identifier during the… |
CVE-2025-43516 | Low | 3.3 | 2025-12-12 | A session management issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. A user with… |
CVE-2023-53776 | High | 8.8 | 2025-12-10 | Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to exploit weak session management by reusing IP-bound session ident… |
CVE-2023-53775 | Medium | 6.5 | 2025-12-10 | Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change user passwords by exploiting weak session management contr… |
CVE-2023-53741 | High | 8.1 | 2025-12-10 | Screen SFT DAB 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP address-bound sessi… |
CVE-2025-63529 | Medium | 6.1 | 2025-12-01 | A session fixation vulnerability exists in Blood Bank Management System 1.0 in login.php that allows an attacker to set or predict a user's session identifier… |
CVE-2025-65681 | Low | 3.3 | 2025-11-26 | An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information… |
CVE-2025-56400 | High | 8.8 | 2025-11-24 | Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mob… |
CVE-2025-63224 | Critical | 10.0 | 2025-11-19 | The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JW… |
CVE-2025-63216 | Critical | 10.0 | 2025-11-18 | The Itel DAB Gateway (IDGat build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid J… |
CVE-2025-37159 | Medium | 5.8 | 2025-11-18 | A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active u… |
CVE-2025-64100 | Medium | 6.1 | 2025-10-29 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, session ids could be fixed by an attac… |
CVE-2025-12390 | Medium | 6.0 | 2025-10-28 | A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happ… |
CVE-2025-56746 | Low | 2.2 | 2025-10-15 | Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attac… |
CVE-2025-10228 | High | 8.8 | 2025-10-14 | Session Fixation vulnerability in Rolantis Information Technologies Agentis allows Session Hijacking.
This issue affects Agentis: before 4.44. |
CVE-2025-59841 | Critical | 9.8 | 2025-09-25 | Flag Forge is a Capture The Flag (CTF) platform. In versions from 2.2.0 to before 2.3.1, the FlagForge web application improperly handles session invalidation… |
CVE-2025-54761 | High | 8.0 | 2025-09-19 | An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie. |
CVE-2025-4644 | | | 2025-08-29 | A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new a… |
CVE-2025-55668 | Medium | 6.5 | 2025-08-13 | Session Fixation vulnerability in Apache Tomcat via rewrite valve.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10… |
CVE-2025-8517 | Medium | 6.3 | 2025-08-04 | A vulnerability was detected in givanz Vvveb 1.0.6.1. Impacted is an unknown function. The manipulation results in session fixiation. The attack can be launche… |
CVE-2025-53102 | Critical | 9.8 | 2025-07-29 | Discourse is an open-source community discussion platform. Prior to version 3.4.7 on the `stable` branch and version 3.5.0.beta.8 on the `tests-passed` branch… |
CVE-2025-0253 | Low | 2.0 | 2025-07-25 | HCL IEM is affected by a cookie attribute not set vulnerability due to inconsistency of certain security-related configurations which could increase exposure t… |
CVE-2025-0251 | Low | 2.6 | 2025-07-25 | HCL IEM is affected by a concurrent login vulnerability. The application allows multiple concurrent sessions using the same user credentials, which may introd… |
CVE-2025-36117 | Medium | 6.3 | 2025-07-23 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the sy… |
CVE-2025-51471 | Medium | 6.9 | 2025-07-22 | Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access contr… |
CVE-2025-52689 | Critical | 9.8 | 2025-07-16 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privileges by spoofing the… |
CVE-2025-53895 | High | 8.8 | 2025-07-15 | ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability i… |
CVE-2025-53021 | Medium | 4.2 | 2025-06-24 | A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey… |
CVE-2024-13967 | High | 8.8 | 2025-06-04 | This vulnerability allows the successful attacker to gain unauthorized access to a
configuration web page delivered by the integrated web Server of EIBPORT.
… |
CVE-2025-46815 | High | 8.0 | 2025-05-06 | The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for… |
CVE-2025-45953 | Critical | 9.1 | 2025-04-28 | A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Imp… |
CVE-2025-45949 | Critical | 9.8 | 2025-04-28 | A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the… |
CVE-2025-42602 | | | 2025-04-23 | This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API endpoints of authentication process. A rem… |
CVE-2025-28242 | Critical | 9.8 | 2025-04-18 | Improper session management in the /login_ok.htm endpoint of DAEnetIP4 METO v1.25 allows attackers to execute a session hijacking attack. |
CVE-2025-28238 | Critical | 9.8 | 2025-04-18 | Improper session management in Elber REBLE310 Firmware v5.5.1.R , Equipment Model: REBLE310/RX10/4ASI allows attackers to execute a session hijacking attack. |
CVE-2024-49709 | Medium | 4.4 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, allows for setting an arbitrary session cookie value. An attacker with an access to user's browser mig… |
CVE-2025-0126 | | | 2025-04-11 | When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and pe… |
CVE-2025-29928 | High | 8.0 | 2025-03-28 | authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage… |
CVE-2025-26658 | Medium | 6.8 | 2025-03-11 | The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unaut… |
CVE-2025-27661 | Critical | 9.1 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004. |
CVE-2025-1412 | Low | 3.1 | 2025-02-24 | Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user t… |
CVE-2024-49344 | Medium | 4.3 | 2025-02-20 | IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages
with Watson Assistant chat feature enabled the application establishes a session when a user logs in an… |
CVE-2022-40916 | Critical | 9.8 | 2025-02-06 | Tiny File Manager v2.4.7 and below is vulnerable to session fixation. |
CVE-2024-42207 | Medium | 5.5 | 2025-02-05 | HCL iAutomate is affected by a session fixation vulnerability. An attacker could hijack a victim's session ID from their authenticated session. |
CVE-2025-22216 | Medium | 5.4 | 2025-01-31 | A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP… |
CVE-2025-24503 | | | 2025-01-30 | A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server. |
CVE-2025-24502 | | | 2025-01-30 | An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by… |
CVE-2024-56529 | High | 7.1 | 2025-01-28 | Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when HSTS is disabled on… |
CVE-2024-57052 | Critical | 9.8 | 2025-01-27 | An issue in youdiancms v.9.5.20 and before allows a remote attacker to escalate privileges via the sessionID parameter in the index.php file. |
CVE-2024-42171 | Medium | 6.4 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-42170 | Medium | 6.8 | 2025-01-11 | HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the vi… |
CVE-2024-13279 | Critical | 9.8 | 2025-01-09 | Session Fixation vulnerability in Drupal Two-factor Authentication (TFA) allows Session Fixation.This issue affects Two-factor Authentication (TFA): from 0.0.0… |