CWE-384
461 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.
- Published CVEs
- 461
- Last 12 months
- 102
- Critical
- 75
- Known exploited
- 1
Critical 75High 165Medium 193Low 27Not scored 1
CVEs per yearBy the year they were published
- 20081
- 20141
- 201734
- 201849
- 201945
- 202041
- 202122
- 202237
- 202345
- 202440
- 202551
- 202692
Known exploitedNewest addition to KEV first
- CVE-2026-102489
Undisclosed RCE in Zammad v6.3 and higher
Zammad GmbH · Zammad
ExploitedHigh8.7
Newest CVEs
- CVE-2026-8639
IBM Verify Directory is affected by multiple vulnerabilities
IBM · Security Verify Directory
High8.8 - CVE-2026-107124
Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeover
Red Hat · Red Hat build of Keycloak 26.6
Medium6.4 - CVE-2026-121501
mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation
mathurvishal · CloudClassroom-PHP-Project
Medium5.3 - CVE-2026-82840
Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication
Apache Software Foundation · Apache Wicket
High7.2 - CVE-2026-117619
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a…
Jenkins Project · Jenkins
High8.1 - CVE-2026-115910
Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim
python-social-auth · social-core
Medium6.8 - CVE-2026-49410
OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation
tinyhumansai · openhuman
High8.1 - CVE-2026-55682
WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php
LabRedesCefetRJ · WeGIA
High8.1 - CVE-2026-107421
WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability
VideoWhisper.com · Broadcast Live Video
High7.3 - CVE-2026-93909
IBM WebSphere Application Server Liberty is affected by an authentication bypass
IBM · WebSphere Application Server - Liberty
Critical9.1