30
42
30
55
30
30
30
42
35
60
55
30
35
30
55
CVE-2026-57967: Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment
CVE-2026-57967: unauthenticated attackers can hijack authenticated ActiveMQ Artemis sessions via crafted CORE protocol SESSION_REATTACH packets.
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session on Apache Artemis and ActiveMQ Artemis. Affected versions are artemis-server 2.50.0 through 2.56.0 in Apache Artemis and artemis-server 1.0.0 through 2.44.0 in Apache ActiveMQ Artemis. Apache rates the issue important.
45
30
60
60
60
47
30
CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
Apache Airflow FAB provider 3.2.0-3.8.x password changes do not invalidate database-backed sessions, letting stolen session cookies survive a password reset.
CVE-2026-86462 affects apache-airflow-providers-fab versions 3.2.0 before 3.9.0. Changing a user's password via the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie retains full access as that user after the password change. Severity is rated moderate.
30
55
60
CitrixBleed 2 Vulnerability Exploited
60
60
60
55
35
42
60
30
60
60
30
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing
Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.
SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.
65
60
60
60