CVE-2026-1758

HighCVSS 8.3/10Last modified Sep 18, 2026

Description

Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation.

This issue affects GateManager: 11.5;0, 11.4.625515072:0.

Fixed in Version 11.6 or 11.4.626194074 and above

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-384

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 15, 2026
Last modified
Sep 18, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-175806.5The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver…CVE-2026-175817.2The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template EnginCVE-2026-175824.9The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderCVE-2026-175838.4The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker coCVE-2026-175855.3The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information ExposureCVE-2026-175866.4The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post MetaCVE-2026-175875.3The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up toCVE-2026-175894.9The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all verCVE-2026-17596.5Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation. This issue afCVE-2026-175913.6A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free CVE-2026-175937.2An account holding the nexus:settings:update permission in Nexus Repository 3 (or the equivalent nexus:settings permission in the legacy NexCVE-2026-175944.9Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creatio