CVE-2026-44188

Ansible-lightspeed: ansible lightspeed: session hijacking and unauthorized data access due to insufficient session expiration

A flaw was found in Ansible Lightspeed. This vulnerability, related to insufficient session expiration, allows a remote attacker to maintain persistent access to the Ansible Lightspeed instance. If an attacker exfiltrates a valid OAuth (Open Authorization) access token before a user logs out, they can continue to authenticate and access sensitive data. This is because the application fails to invalidate the token on the backend, leaving it valid until its natural expiration. This can lead to unauthorized read access to Ansible resources such as inventories, playbooks, and configuration data.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Automation Platform

CVE-2026-76572

pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue. The patch is identified as 78c699370ea43ae2784e1c4ace7c947d207f2b47. Upgrading the affected component is advised.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Pkp

Products

Pkp-lib

CVE-2026-56748

Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link in the pack's functions directory.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Cribl

Products

Cribl Stream

CVE-2026-65984

FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js re-signs inbound JWT claims without validating the current database record. An attacker who possesses a previously issued privileged refresh cookie or access token can continue minting privileged JWTs after account deletion, disablement, role removal, or demotion. Continued refresh-cookie rotation can extend the stale session and preserve unauthorized access to user management, project manipulation, runtime configuration, scripts, and backdoor-account creation. This issue is fixed in version 1.3.3.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Frangoteam

Products

Fuxa

CVE-2026-68251

drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() There's no need to crash the kernel for these cases. (cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87)

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-68246

drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() There's no need to crash the kernel for these cases. (cherry picked from commit daa62107452d2451787c4248ca38fa2d1a0cbefd)

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2020-15670

Mozilla: Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2

Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Firefox Esr Firefox Mobile and 1 more

CVE-2023-29536

Mozilla: Invalid free from JavaScript code

An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Firefox Mobile and 7 more

CVE-2026-52829

ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwarded the raw transient address to MetaAddrChange::UpdateMisbehavior. In zebra-network/src/meta_addr.rs, apply_to_meta_addr then compared the canonical address-book entry with the raw update address and reached its unexpected address mismatch assertion. After the misbehavior batch flush, panic equals abort terminated zebrad; the peer only needed to complete a P2P handshake and advertise an invalid mempool transaction. This issue is fixed in version 4.5.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Zcashfoundation

Products

Zebra

CVE-2026-17574

NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.

CVSS 4.0 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Hdfgroup

Products

Hdf5

CVE-2026-45791

Dokploy: Password Change Does Not Revoke Active Sessions

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.session_token session to remain valid for up to three days after a password change. This issue is fixed in version 0.29.6.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-13073

MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination

An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation options.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Mongodb Server

CVE-2026-72173

fs/proc/task_mmu: do not warn on seeing non-migration pmd entry

In the Linux kernel, the following vulnerability has been resolved: fs/proc/task_mmu: do not warn on seeing non-migration pmd entry Patch series "mm/hmm: A fix and a selftest", v3. Patch 1 fixes a stale warning present from the time when only migration softleaf entries were supported at the PMD level. Patch 2 adds some code into hmm-tests.c which exercises the pagemap path for PMD device-private entries. This patch (of 2): pagemap_pmd_range_thp() warns if a non-present PMD is not a migration entry. This became false once device-private entries at the PMD level were added. Therefore, remove the stale migration-only assertion.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-73611

File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Filebrowser

Products

Filebrowser

CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Gitea

Products

Gitea Open Source Git Server

CVE-2026-54366

CentreStack < 17.4 XXE via SharePoint Storage Configuration

CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD references, resulting in out-of-band file exfiltration of sensitive files such as Web.config, which may contain database credentials and cryptographic key material.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Gladinet

Products

Centrestack

CVE-2026-53802

rsync < 3.5.0 Arbitrary File Read via Symlink Following

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Rsync Project Samba

Products

Rsync Rsync

CVE-2026-39924

Flarum < 1.8.16 Session Persistence via Improper Access Token Revocation

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never cleared on password change events. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table while leaving all active session cookies and API bearer tokens intact, including long-lived RememberAccessToken entries, and administrator-forced password resets via the user update endpoint are equally ineffective at revoking attacker-held sessions.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Flarum

Products

Flarum Framework

CVE-2026-18715

IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2025-15684

Open5GS CER init.c diam_log_func assertion

A vulnerability was detected in Open5GS up to 2.7.6. Affected is the function diam_log_func of the file lib/diameter/common/init.c of the component CER Handler. The manipulation results in reachable assertion. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 2.7.7 is able to address this issue. The patch is identified as c1a803516a3c0485696cb9bcca7a80ad857c7383. It is advisable to upgrade the affected component.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Open5gs

Products

Open5gs