Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-0696

Session Cookies Missing HttpOnly Attribute

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Connectwise
Products
Professional Service Automation Psa
CVE-2026-0695

Stored XSS in Time Entry Audit Trail

In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected content is displayed.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Connectwise
Products
Professional Service Automation Psa