Exposure of Data Element to Wrong Session

Every one of the 55 is a mark on the map. Named now: 1 to 26, most at risk first.

1. CoacoaPods trunk sessions verification step could be manipulated for owner session hijackingCVE-2024-38367CocoaPods · CVSS 8.2 · 11% likely
2. Undertow: url-encoded request path information can be broken on ajp-listenerCVE-2024-6162Red Hat · CVSS 7.5 · 1.7% likely

   Red Hat

3. In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokensCVE-2026-86492JetBrains · CVSS 8.5 · 0.9% likely

   JetBrains

4. native CA store conn reuseCVE-2026-80231curl · CVSS 7.5 · 0.9% likely

   The Curl Project

5. Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instanceCVE-2025-1247Red Hat · CVSS 8.3 · 0.8% likely

   Red Hat

6. Negotiate ambient user conn reuseCVE-2026-19931curl · CVSS 9.8 · 0.7% likely

   The Curl Project

7. Deno's Node.js Compatibility Runtime has Cross-Session Data ContaminationCVE-2024-27935denoland · CVSS 7.2 · 0.7% likely

   Denoland

8. Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request StateCVE-2026-85296Apache Software Foundation · CVSS 6.5 · 0.7% likely

   Apache

9. local interface connection reuse mixupCVE-2026-107929curl · CVSS 8.1 · 0.7% likely

   The Curl Project

10. In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in As…CVE-2024-27455CVSS 9.1 · 0.6% likely
11. Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`CVE-2025-47928spotipy-dev · CVSS 9.1 · 0.6% likely
12. wrong reuse of SMB connectionCVE-2026-5773curl · CVSS 7.5 · 0.6% likely

    The Curl Project

13. Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificateCVE-2024-5148Red Hat · CVSS 7.5 · 0.6% likely

    Red Hat

14. consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless modeCVE-2026-16326HashiCorp · CVSS 10 · 0.5% likely

    HashiCorp

15. Seeing admin password hash value in Mia Technology's Mia-MedCVE-2023-6519Mia Technology Inc. · CVSS 7.5 · 0.5% likely

    Mia Technology Inc.

16. Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization TargetCVE-2026-85245Apache Software Foundation · CVSS 5.9 · 0.5% likely

    Apache

17. terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless modeCVE-2026-16498HashiCorp · CVSS 10 · 0.5% likelycovered by CyberSIXT

    HashiCorp

18. Improper authorization controls in PaperCut NG/MFCVE-2024-1223PaperCut · CVSS 4.8 · 0.4% likely

    PaperCut

19. Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong sessionCVE-2023-1907Pgadmin · CVSS 8 · 0.4% likely
20. A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8…CVE-2024-41977Siemens · CVSS 7.1 · 0.4% likely

    Siemens

21. FTP connection reuse inherits client-certificateCVE-2026-86411curl · CVSS 9.1 · 0.4% likely

    The Curl Project

22. Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerCVE-2026-115419AWS · CVSS 8.1 · 0.4% likely

    AWS

23. IBM ContextForge Translate is affected by cross-client credential context confusionCVE-2026-18489IBM · CVSS 7.4 · 0.4% likely

    IBM

24. Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topicCVE-2026-82367ash-project · CVSS 2.3 · 0.4% likely

    Ash-Project

25. n8n: Merge Node SQL Mode Prototype PollutionCVE-2026-54311n8n-io · CVSS 6 · 0.4% likely

    N8n-Io

26. 404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information ExposureCVE-2024-11094aaron13100 · CVSS 5.3 · 0.4% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.