CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
@fastify/secure-session Signature Verification Bypass and Session Invalidation Evasion (CVE-2026-117549)
[Affected Scope] Node.js applications using @fastify/secure-session versions 7.5.0 through 8.4.1 configured with the signed cookie option
[Impact] Attackers holding an expired or revoked session can strip the obsolete signature and continue using the session, bypassing session invalidation attempts that rely solely on rotating the cookie signing secret
[Mitigation] Upgrade @fastify/secure-session to version 8.4.2 or later, or rotate the session encryption key instead of relying only on the cookie signing secret
TeleMessage Archiving Backend Cleartext Message Storage and E2EE Bypass Vulnerability (CVE-2025-47729)
[Affected Scope] TeleMessage archiving backend through 2025-05-05 and TM SGNL (Archive Signal) application
[Impact] Contrary to advertised End-to-End Encryption (E2EE), messages are stored in cleartext on the backend, allowing authorized or compromised accounts to access sensitive communications, which has been actively exploited in the wild
[Mitigation] Restrict network access to the archiving backend, audit stored data for cleartext exposure, and apply emergency vendor patches and architectural updates immediately