Skip to contentCWE-613 vulnerabilities
- cloudcharge cloudcharge.seCloudCharge cloudcharge.se Insufficient Session ExpirationCVE-2026-276526.9 Medium
- chargemap chargemap.comChargemap chargemap.com Insufficient Session ExpirationCVE-2026-257116.9 Medium
- morelitea initiativeInitiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)CVE-2026-282758.1 High
- packistryPackistry accepts expired access tokensCVE-2026-279684.3 Medium
- manyfoldManyfold vulnerable to session hijack via cookie leakage in proxy cachesCVE-2026-279336.8 Medium
- go-vikunja vikunjaVijkunja has Weak Password Policy Combined with Persistent Sessions After Password ChangeCVE-2026-275759.1 Critical
- open-emr openemrOpenEMR has Session Timeout Bypass via skip_timeout_resetCVE-2026-254767.5 High
- tattile s.r.l. smart+, tattile anpr mobile firmware, axle counter firmware +17 more +19 moreTattile Smart+ / Vega / Basic <= 1.181.5 Insufficient Session Token ExpirationCVE-2026-263428.7 High
- softiron hypercloudHyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized AccessCVE-2026-18426.2 Medium
- graylog, graylog web interface +1 moreIncorrect management of session invalidation vulnerability in Graylog Web InterfaceCVE-2026-14359.3 Critical
- ibm security qradar edrIBM Security QRadar EDR Software has multiple vulnerabilitiesCVE-2025-363766.3 Medium
- ibm qradar edr, security qradar edr +1 moreIBM Security QRadar EDR Software has multiple vulnerabilitiesCVE-2025-363776.3 Medium
- ibm db2 recovery expert for luw, db2 recovery expert +1 moreMultiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsCVE-2025-278986.3 Medium
github.com/pterodactyl/wings Go, pterodactyl/panel Packagist +1 morePterodactyl Panel's SFTP sessions remain active after user account deletion or password changeGHSA-hr7j-63v7-vj7gFix available7.5 High- php frankenphpFrankenPHP leaks session data between requests in worker modeCVE-2026-24894Fix available8.7 High
- ibm concertMultiple Vulnerabilities in IBM Concert SoftwareCVE-2024-431816.3 Medium
- gunet open eclass platform, openeclass +1 moreOpen eClass Insecure Password Reset Token Reuse Enables Account TakeoverCVE-2026-246697.8 High
- gunet open eclass platform, openeclass +1 moreOpen eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account AccessCVE-2026-246675.0 Medium
- honoHono cache middleware ignores "Cache-Control: private" leading to Web Cache DeceptionCVE-2026-24472Fix available5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.10, jboss enterprise application platform 8 +2 more +4 moreOrg.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdataCVE-2026-11903.1 Low
- evmapaEVMAPA Insufficient Session ExpirationCVE-2025-557057.3 High
- ibm sterling connect:express adapter for sterling b2b integrator 5.2.0, sterling connect\ +1 moreMultiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.CVE-2025-360656.3 Medium
- ibm sterling connect:express adapter for sterling b2b integrator 5.2.0, sterling connect\ +1 moreMultiple vulnerabilities were addressed in IBM Sterling Connect:Express for UNIX.CVE-2025-360636.3 Medium
- hotwired turboTurbo Frame responses can restore stale session cookiesCVE-2025-66803Fix available4.8 Medium
- hcl aionHCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase...CVE-2025-526612.4 Low
- abb webpro snmp card powervalue, webpro snmp card powervalue ul +1 moreIdle session timeout is not configured for multiple open portsCVE-2025-46777.1 High
- hclsoftware bigfix ivr, hcltech bigfix insights for vulnerability remediation +1 moreHCL BigFix IVR is impacted by an insufficient session expiration vulnerabilityCVE-2025-319622.0 Low
- convoypanel panel, pterodactyl wings +1 morePterodactyl does not revoke SFTP access when server is deleted or permissions reducedCVE-2025-68954Fix available7.5 High
- kz broadband technologies, ltd. jt3500v, am3000m, am3100e +12 more +14 moreKZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration VulnerabilityCVE-2021-477406.9 Medium
- kantar media wm2, sound4 big voice2 firmware, big voice4 firmware +12 more +14 moreSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration VulnerabilityCVE-2022-506926.9 Medium
- hcl software bigfix remote control, hcltechsw hcl devops deploy, hcl launch +2 moreHCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)CVE-2025-552543.7 Low
- hcltechsw hcl devops deploy, hcl launch, hcl software devops deploy / launch +2 moreHCL DevOps Deploy / HCL Launch is susceptible to an insufficient session expiration vulnerabilityCVE-2025-623295.0 Medium
- ibm devops deploy, ucd - ibm devops deploy, ucd - ibm urbancode deploy +1 more +3 moreIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Insufficient Session Expiration vulnerabilityCVE-2025-363605.0 Medium
- allauthdjango-allauth does not reject access tokens for inactive usersCVE-2025-65430Fix available5.4 Medium
- fortinet fortiosAn insufficient session expiration vulnerability [CWE-613] in Fortinet FortiOS 7.4.0, FortiOS 7.2...CVE-2025-626315.3 Medium
- genexis platinum 4410 firmwareA vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2–1.41)...CVE-2025-658838.4 High
- nopcommerceCVE-2025-11699CVE-2025-116997.1 High
- orangehrmOrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password ChangeCVE-2025-662898.7 High
- openobserveOpenObserve's Invite Token Lifecycle MisconfigurationCVE-2025-662238.4 High
- accellion kiteworks managed file transfer, kiteworks security-advisories +1 moreKiteworks MFT is vulnerable to Insufficient Session ExpirationCVE-2025-538967.1 High
- goauthentik authentikauthentik invitation expiry is delayed by at least 5 minutesCVE-2025-64708Fix available5.8 Medium
- sencore decoder-ccv2 firmware, en2sdi-2hd firmware, smp100 firmware +2 moreThe Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is...CVE-2025-632265.7 Medium
- requarks wiki.jsRequarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user...CVE-2025-56643Public exploit9.1 Critical
- flowiseFlowise - Session Invalidation Failure After Password ChangeCVE-2025-71335Fix available8.6 High
- hcl software devops loopHCL DevOps Loop is susceptible to an improper authentication vulnerabilityCVE-2025-552788.1 High
- circutor tcprs1plusHIJACKING OF THE TOKEN AND GAINING ACCESSCVE-2025-643867.7 High
- nagios xiNagios XI < 2024R1.1.3 Session Not Invalidated After Password ChangeCVE-2024-139969.2 Critical
- arista networks danz monitoring fabricOn affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a confi…CVE-2025-545475.3 Medium
- thm pilosPILOS is missing session regeneration after password changeCVE-2025-627815.0 Medium
- azure access technology blu-ic2, blu-ic4, azure-access blu-ic2 firmware +1 more +3 moreLogout Functionality not WorkingCVE-2025-122786.9 Medium
- Show moreLoading…