CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens
CVE-2026-92414 lets unauthenticated attackers hijack cached Apache Jackrabbit WebDAV sessions and is rated CVSS 9.3.
Stories per day · 30 days
1 RSS
9 stories, newest first · one card per story
Stories tagged #session-fixation
CISA Warns of Zammad DIVD Vulnerabilities Actively Exploited in Attacks
CISA warned that two exploited Zammad flaws can be chained into full helpdesk server takeover.
CISA Adds Zammad Vulnerabilities to KEV Following Active Exploitation
CISA added two exploited Zammad flaws to KEV that chain into root-level remote code execution.
U.S. CISA adds Zammad GmbH Zammad flaws to its Known Exploited Vulnerabilities catalog
CISA added two exploited Zammad zero-days to KEV after attackers chained them to breach DIVD.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two actively exploited Zammad flaws, session fixation and improper privilege management, to the KEV catalog.
CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin
Apache APISIX feishu-auth and dingtalk-auth allow session fixation through a crafted link (CVE-2026-94220).
CVE-2026-92609: Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication
Apache Qpid Broker-J through 10.1.0 has a session-fixation flaw in HTTP management authentication.
CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation
Apache Airflow lets a session cookie override a bearer token, enabling session fixation.
CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
Apache Airflow FAB provider 3.2.0-3.8.x password changes do not invalidate database-backed sessions, letting stolen session cookies survive a password reset.