CWE-488 · Information Disclosure
Exposure of Data Element to Wrong Session
55CVEs
SortMost likely exploited
55 CVEs with CWE-488 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-38367CoacoaPods trunk sessions verification step could be manipulated for owner session hijackingCocoaPods · CocoaPods · CVSS 8.2 · 2024-07-01 | 8.2 | 11% | 2024-07-01 |
| CVE-2024-6162Undertow: url-encoded request path information can be broken on ajp-listenerRed Hat · EAP 8.0.1 · CVSS 7.5 · 2024-06-20 | 7.5 | 1.7% | 2024-06-20 |
| CVE-2026-86492In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokensJetBrains · YouTrack · CVSS 8.5 · 2026-09-07 | 8.5 | 0.9% | 2026-09-07 |
| CVE-2026-80231native CA store conn reusecurl · curl · CVSS 7.5 · 2026-09-06 | 7.5 | 0.9% | 2026-09-06 |
| CVE-2025-1247Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared instanceRed Hat · Red Hat Build of Apache Camel 4.8 for Quarkus 3.15 · CVSS 8.3 · 2025-02-13 | 8.3 | 0.8% | 2025-02-13 |
| CVE-2026-19931Negotiate ambient user conn reusecurl · curl · CVSS 9.8 · 2026-09-06 | 9.8 | 0.7% | 2026-09-06 |
| CVE-2024-27935Deno's Node.js Compatibility Runtime has Cross-Session Data Contaminationdenoland · deno · CVSS 7.2 · 2024-03-06 | 7.2 | 0.7% | 2024-03-06 |
| CVE-2026-85296Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request StateApache Software Foundation · Apache Camel · CVSS 6.5 · 2026-10-19 | 6.5 | 0.7% | 2026-10-19 |
| CVE-2026-107929local interface connection reuse mixupcurl · curl · CVSS 8.1 · 2026-10-20 | 8.1 | 0.7% | 2026-10-20 |
| CVE-2024-27455In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in As…No vendor recorded · CVSS 9.1 · 2024-02-26 | 9.1 | 0.6% | 2024-02-26 |
| CVE-2025-47928Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`spotipy-dev · spotipy · CVSS 9.1 · 2025-05-15 | 9.1 | 0.6% | 2025-05-15 |
| CVE-2026-5773wrong reuse of SMB connectioncurl · curl · CVSS 7.5 · 2026-05-13 | 7.5 | 0.6% | 2026-05-13 |
| CVE-2024-5148Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificateRedhat · gnome-remote-desktop · CVSS 7.5 · 2024-09-02 | 7.5 | 0.6% | 2024-09-02 |
| CVE-2026-16326consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless modeHashiCorp · Tooling · CVSS 10 · 2026-07-29 | 10.0 | 0.5% | 2026-07-29 |
| CVE-2023-6519Seeing admin password hash value in Mia Technology's Mia-MedMia Technology Inc. · MİA-MED · CVSS 7.5 · 2024-02-08 | 7.5 | 0.5% | 2024-02-08 |
| CVE-2026-85245Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization TargetApache Software Foundation · Apache Camel · CVSS 5.9 · 2026-10-19 | 5.9 | 0.5% | 2026-10-19 |
| CVE-2026-16498terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless modeHashiCorp · Tooling · CVSS 10 · 2026-07-28 | 10.0 | 0.5% | 2026-07-28 |
| CVE-2024-1223Improper authorization controls in PaperCut NG/MFPaperCut · PaperCut NG, PaperCut MF · CVSS 4.8 · 2024-03-14 | 4.8 | 0.4% | 2024-03-14 |
| CVE-2023-1907Pgadmin: users authenticated simultaneously via ldap may be attached to the wrong sessionPgadmin · Pgadmin · CVSS 8 · 2025-01-09 | 8.0 | 0.4% | 2025-01-09 |
| CVE-2024-41977A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8…Siemens · RUGGEDCOM RM1224 LTE(4G) EU · CVSS 7.1 · 2024-08-13 | 7.1 | 0.4% | 2024-08-13 |
| CVE-2026-86411FTP connection reuse inherits client-certificatecurl · curl · CVSS 9.1 · 2026-10-20 | 9.1 | 0.4% | 2026-10-20 |
| CVE-2026-115419Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerAWS · strands-agents · CVSS 8.1 · 2026-10-22 | 8.1 | 0.4% | 2026-10-22 |
| CVE-2026-18489IBM ContextForge Translate is affected by cross-client credential context confusionIBM · ContextForge MCP Gateway - Translate utility · CVSS 7.4 · 2026-09-04 | 7.4 | 0.4% | 2026-09-04 |
| CVE-2026-82367Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topicash-project · ash_graphql · CVSS 2.3 · 2026-08-30 | 2.3 | 0.4% | 2026-08-30 |
| CVE-2026-54311n8n: Merge Node SQL Mode Prototype Pollutionn8n-io · n8n · CVSS 6 · 2026-06-23 | 6.0 | 0.4% | 2026-06-23 |
| CVE-2024-11094404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposureaaron13100 · 404 Solution · CVSS 5.3 · 2024-11-16 | 5.3 | 0.4% | 2024-11-16 |
| CVE-2026-23646OpenProject users can delete other user's session, causing them to be logged outopf · openproject · CVSS 6.5 · 2026-01-19 | 6.5 | 0.4% | 2026-01-19 |
| CVE-2025-30073An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0. The reference assigned to transactions can be reused. When completing a payment, the first or all transactions…No vendor recorded · CVSS 7.5 · 2025-03-26 | 7.5 | 0.4% | 2025-03-26 |
| CVE-2026-8458wrong reuse for different servicescurl · curl · CVSS 6.5 · 2026-07-03 | 6.5 | 0.4% | 2026-07-03 |
| CVE-2026-120634CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser bufferCGI · CVSS 6.5 · 2026-11-03 | 6.5 | 0.4% | 2026-11-03 |
| CVE-2026-14621FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong sessionFederatedAI · FATE · CVSS 3.1 · 2026-07-04 | 3.1 | 0.4% | 2026-07-04 |
| CVE-2026-112921Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous requestNo vendor recorded · CVSS 7.3 · 2026-10-21 | 7.3 | 0.4% | 2026-10-21 |
| CVE-2026-121966Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leaktraefik · traefik · CVSS 8.7 · 2026-11-04 | 8.7 | 0.3% | 2026-11-04 |
| CVE-2026-46416Microsoft UFO shared WebSocket handler state causes cross-client response hijackingmicrosoft · UFO · CVSS 6.3 · 2026-05-27 | 6.3 | 0.3% | 2026-05-27 |
| CVE-2026-82806Apache APISIX: cross-request permission pollution via static permission list mutationApache Software Foundation · Apache APISIX · CVSS 5.3 · 2026-10-01 | 5.3 | 0.3% | 2026-10-01 |
| CVE-2026-114637Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leaktraefik · traefik · CVSS 8.7 · 2026-10-22 | 8.7 | 0.3% | 2026-10-22 |
| CVE-2026-84685Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential ManagementAuth0 · react-native-auth0 · CVSS 6.5 · 2026-09-08 | 6.5 | 0.3% | 2026-09-08 |
| CVE-2026-71850Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosurehonojs · hono · CVSS 4.8 · 2026-08-07 | 4.8 | 0.3% | 2026-08-07 |
| CVE-2026-23919Insufficient isolation of JavaScript (Duktape) execution context on Zabbix ServerZabbix · Zabbix · CVSS 7.1 · 2026-03-24 | 7.1 | 0.2% | 2026-03-24 |
| CVE-2026-88017rclone: FTP cross-session auth-proxy backend confusionrclone · rclone · CVSS 7.3 · 2026-09-10 | 7.3 | 0.2% | 2026-09-10 |
| CVE-2026-122233FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Modephp · frankenphp · CVSS 3.7 · 2026-11-04 | 3.7 | 0.2% | 2026-11-04 |
| CVE-2026-111242Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identityApache Software Foundation · Apache TomEE · 2026-11-10 | – | 0.2% | 2026-11-10 |
| CVE-2026-103544datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong sessiondatadrivenconstruction · OpenConstructionERP · CVSS 6.3 · 2026-10-01 | 6.3 | 0.2% | 2026-10-01 |
| CVE-2026-103869Pulp-ansible: bearer tokens are reused across remotes in a workerRed Hat · Red Hat Ansible Automation Platform 2 · CVSS 6.5 · 2026-10-07 | 6.5 | 0.2% | 2026-10-07 |
| CVE-2026-103868Pulp-container: registry credentials are reused across remotes in a workerRed Hat · Red Hat Ansible Automation Platform 2 · CVSS 6.5 · 2026-10-07 | 6.5 | 0.2% | 2026-10-07 |
| CVE-2026-23844Whisper Money has IDOR Vulnerability on sync/balances endpointwhisper-money · whisper-money · CVSS 4.9 · 2026-01-19 | 4.9 | 0.2% | 2026-01-19 |
| CVE-2026-111245Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requestsApache Software Foundation · Apache TomEE · 2026-11-10 | – | 0.2% | 2026-11-10 |
| CVE-2025-24934SO_REUSEPORT_LB breaks connect(2) for UDP socketsFreeBSD · FreeBSD · CVSS 5.4 · 2025-10-22 | 5.4 | 0.2% | 2025-10-22 |
| CVE-2025-2312cifs.upcall makes an upcall to the wrong namespace in containerized environmentscifs-utils · cifs-utils · CVSS 5.9 · 2025-03-25 | 5.9 | 0.2% | 2025-03-25 |
| CVE-2026-97888Apache TomEE: Caller identity leaks across requests in embedded HTTP serverApache Software Foundation · Apache TomEE · 2026-11-10 | – | 0.2% | 2026-11-10 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.