Skip to contentCWE-613 vulnerabilities
- ci4-cms-erp ci4msCI4MS: Deactivated User Session Bypass (active=0)CVE-2026-41891Fix available5.3 Medium
- weblateWeblate's API Token Not Invalidated on Password ChangeCVE-2026-41519Fix available4.2 Medium
- curlwrong reuse of HTTP Negotiate connectionCVE-2026-5545Fix available6.5 Medium
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Insufficient session expirationCVE-2026-257206.9 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilitiesCVE-2026-12722.7 Low
- gitlabInsufficient Session Expiration in GitLabCVE-2026-6515Fix available5.4 Medium
- redhat quay, red hat quay 3 +1 moreQuay: red hat quay: authentication bypass allows privileged actions without valid credentialsCVE-2026-68485.4 Medium
- blueprintue blueprintue-self-hosted-editionblueprintUE: Active Sessions Are Not Invalidated After Password Change or ResetCVE-2026-405876.5 Medium
- fortra goanywhere mft, goanywhere managed file transfer +1 moreGoAnywhere MFT SAML Sessions do not redirect to logout URL on session timeoutCVE-2026-09714.3 Medium
- wso2 identity serverImproper Token Invalidation in WSO2 Identity Server Allows Access After Account LockCVE-2025-126246.0 Medium
- datasharingframework dsf, dev.dsf dsf-bpe-server, dsf-common-jetty +1 more +3 moreDSF: Missing Session Timeout for OIDC SessionsCVE-2026-40939Fix available6.8 Medium
pyload-ng PyPIpyLoad's Session Not Invalidated After Permission ChangesGHSA-fj52-5g4h-gmq82.9 Low- pyloadpyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass)CVE-2026-411338.8 High
- oauth2 proxy project proxy, oauth2-proxy +1 moreOAuth2 Proxy: Session cookie not cleared when rendering sign-in pageCVE-2026-34454Fix available3.5 Low
- go-vikunja vikunjaVikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgradeCVE-2026-35594Fix available6.5 Medium
- openclawOpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token RotationCVE-2026-42421Fix available2.3 Low
- openclawOpenClaw < 2026.4.8 - Stale Authentication State via Config ReloadCVE-2026-41916Fix available2.3 Low
- apache airflowApache Airflow: Airflow Logout Not Invalidating JWTCVE-2025-57735Fix available9.1 Critical
- parisneo parisneo/lollmsInsufficient Session Expiration in parisneo/lollmsCVE-2026-11634.1 Medium
- papraPapra Does Not Reject Expired API KeysCVE-2026-354624.3 Medium
- runzero platformrunZero Platform session timeout failureCVE-2026-53765.9 Medium
- openclawOpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotateCVE-2026-41356Fix available2.3 Low
- knadh listmonklistmonk: Active sessions remain valid after password reset and password changeCVE-2026-34828Public exploitFix available7.1 High
- ibm aspera sharesMultiple vulnerabilities have been addressed in IBM Aspera SharesCVE-2025-664836.3 Medium
- ci4-cms-erp ci4msCI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)CVE-2026-34572Fix available8.8 High
- ci4-cms-erp ci4msCI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)CVE-2026-34570Fix available8.8 High
- openclawOpenClaw < 2026.3.28 - Incomplete WebSocket Session Termination on Device Removal and Token RevocationCVE-2026-34503Fix available8.6 High
- fleetdm fleetFleet: Password reset tokens remain valid after password change for 24 hoursCVE-2026-26060Fix available6.0 Medium
- wwbn avideoAVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()CVE-2026-343625.4 Medium
- hcl aftermarket dpc, hcltech aftermarket cloud +1 moreHCL Aftermarket DPC is affected by Failure to Invalidate Session on Password ChangeCVE-2025-552645.5 Medium
- ibm infosphere information serverIBM InfoSphere Information Server is vulnerable due to insufficient session expirationCVE-2025-148106.3 Medium
- accellion kiteworks, kiteworks email protection gateway +1 moreKiteworks Email Protection Gateway has an Insufficient Session ExpirationCVE-2026-290924.9 Medium
- ellite wallosWallos: Password Reset Tokens Never ExpireCVE-2026-334176.5 Medium
- igl eparking.fiIGL-Technologies eParking.fi Insufficient Session ExpirationCVE-2026-326636.9 Medium
- ctek chargeportal, charge portal +1 moreCTEK Chargeportal Insufficient Session ExpirationCVE-2026-276496.9 Medium
- truesec lapswebuiInsecure Logout Functionality in Truesec LAPSWebUICVE-2025-155536.0 Medium
- truesec lapswebuiLong Session Lifetime in Truesec LAPSWebUICVE-2025-155526.0 Medium
- zitadelZITADEL: Reactivation of Expired Passkey Registration CodesCVE-2026-321327.4 High
- everon api.everon.ioEveron api.everon.io Insufficient Session ExpirationCVE-2026-207486.9 Medium
- mobiliti e-mobi.hu, mvm mobiliti e-mobi.hu +1 moreMobiliti e-mobi.hu Insufficient Session ExpirationCVE-2026-277646.9 Medium
- epower epower.ieePower epower.ie Insufficient Session ExpirationCVE-2026-249126.9 Medium
- hex hexpm, hexpm hex.pm +1 morePassword Reset Tokens Do Not ExpireCVE-2026-216229.5 Critical
- olivetinOliveTin: Session Fixation - Logout Fails to Invalidate Server-Side SessionCVE-2026-30224Fix available5.4 Medium
- 2n access commanderCookies are not Invalidated upon Logout and Password ChangeCVE-2025-597866.0 Medium
- nocodbNocoDB: Refresh Tokens Not Revoked on Password ResetCVE-2026-28396Fix available4.9 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System session expirationCVE-2026-34012.3 Low
- mobility46 mobility46.seMobility46 mobility46.se Insufficient Session ExpirationCVE-2026-276476.9 Medium
- ev energy ev.energyEV Energy ev.energy Insufficient Session ExpirationCVE-2026-262906.9 Medium
- switch ev swtchenergy.comSWITCH EV swtchenergy.com Insufficient Session ExpirationCVE-2026-257786.9 Medium
- ev2go ev2go.ioEV2GO ev2go.io Insufficient Session ExpirationCVE-2026-208956.9 Medium
- Show moreLoading…