CWE-488
CVEs classified under CWE-488, newest first.
32 CVEsRSS
CVE-2026-115419High· 8.1Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
CVE-2026-114637High· 8.7Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthent…
CVE-2026-112921NoneRobots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machi…
CVE-2026-101722Medium· 4.3mysql: mysql: unauthorized read access via connection handling (CVE-2026-101722)
A flaw was found in the MySQL connection handling component. A remote attacker with low privileges and network access can exploit this vulnerability using multiple protocols. Successful exploitation results in unauthorized read access to a…
CVE-2026-86411NoneFTP connection reuse inherits client-certificate
An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `STARTTLS` and authenticated using a client certificate. The second handle performs neither a new …
CVE-2026-101356Medium· 5.3⚖ disputedtomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing (CVE-2026-101356)
A flaw was found in Apache Tomcat. Incorrect object recycling and reuse during the HTTP/2 processing of asynchronous servlets can cause requests and responses to be mixed up between different users. A remote attacker could exploit this vul…
CVE-2026-85245Medium· 5.9PoCApache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target
Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into th…
CVE-2026-85296Medium· 6.5PoCApache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored…
CVE-2026-107929Low· 3.7curl: curl: local interface connection reuse mixup (CVE-2026-107929)
A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in…
CVE-2026-82416High· 7.7FrankenPHP is a modern application server for PHP
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION …
CVE-2026-97791High· 7.5In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's r…
CVE-2026-103869Medium· 6.5A flaw was found in pulp-ansible's bearer-token refresh for collection remotes
A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses tok…
CVE-2026-103868Medium· 6.5A flaw was found in pulp-container when it authenticates to an upstream registry
A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that …
CVE-2026-106555Low· 2.2In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
CVE-2026-82806Medium· 5.3Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into…
Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into…
CVE-2026-103544Medium· 6.3PoCA vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1
A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/ai_client.py of the component Al Provider Configuration Handler. Perform…
CVE-2026-88017High· 7.3rclone is a command-line program to sync files and directories to and from different cloud storage providers
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the se…
CVE-2026-84685Medium· 6.5The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests
The react-native-auth0 SDK's web platform implementation does not scope its in-memory token cache to individual user sessions when operating in a server-side rendering (SSR) environment where module state persists across HTTP requests. U…
CVE-2026-86492High· 8.5In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
CVE-2026-80231High· 7.5PoC⚖ disputedA flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.
A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created.
CVE-2026-19931Critical· 9.8PoC⚖ disputedA flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials
A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previo…
CVE-2026-18489High· 7.4IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.
IBM ContextForge MCP Gateway - Translate utility <= 1.0.8 MCP Context Forge could allow a remote attacker to obtain sensitive information from other sessions due to exposure of data elements to the wrong session.
CVE-2026-82367NoneExposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch fro…
Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.do_send/5 reads the resolved batch fro…
CVE-2026-71850Medium· 4.8Hono is a Web application framework that provides support for any JavaScript runtime
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.8.0 to 4.12.33, memo() from hono/jsx retains the result of a server side render and reuses it for later renders with comparator equal props, and…
CVE-2026-54497Medium· 6.8ViewComponent: Reused Component Instances Retain Stale Render Context
ViewComponent: Reused Component Instances Retain Stale Render Context
CVE-2026-14621Low· 3.1A vulnerability has been found in FederatedAI FATE up to 2.2.0
A vulnerability has been found in FederatedAI FATE up to 2.2.0. This affects the function QueuePushReqStreamObserver.initEggroll of the file java/osx/osx-broker/src/main/java/org/fedai/osx/broker/grpc/QueuePushReqStreamObserver.java of t…
CVE-2026-8458Medium· 6.5PoClibcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests …
libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different "services". libcurl features a pool of recent connections so that subsequent requests …
CVE-2026-54311Medium· 6.3n8n: Merge Node SQL Mode Prototype Pollution
n8n: Merge Node SQL Mode Prototype Pollution
CVE-2026-5773High· 7.5PoClibcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connectio…
libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connectio…
CVE-2026-5545Medium· 6.5libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that sub…
libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host. libcurl features a pool of recent connections so that sub…