CVE-2026-3269

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A flaw has been found in psi-probe PSI Probe up to 5.3.0. The impacted element is the function handleRequestInternal of the file psi-probe-core/src/main/java/psiprobe/controllers/sessions/ExpireSessionsController.java of the component Session Handler. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404

Affected software

Vendor	Product	Versions
psi-probe	PSI Probe	5.0; 5.1; 5.2; 5.3.0

References

https://github.com/AnalogyC0de/public_exp/issues/13Exploit, Third Party Advisory
https://vuldb.com/?ctiid.347993Permissions Required, VDB Entry
https://vuldb.com/?id.347993Third Party Advisory, VDB Entry
https://vuldb.com/?submit.758665Third Party Advisory, VDB Entry

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-326903.7Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets s CVE-2026-326915.3A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim owner CVE-2026-326926.5An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authentic CVE-2026-326938.8In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to CVE-2026-326946.6In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusiv CVE-2026-326957.7Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider builds router rules CVE-2026-326967.5NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In NanoMQ version 0.24.6, after enabling auth.http_auth (HTTP authenti CVE-2026-326976.5SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the `Reco CVE-2026-326987.2OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to CVE-2026-326995.3FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the n CVE-2026-32708.8A vulnerability has been found in psi-probe PSI Probe up to 5.3.0. This affects the function lookup of the file psi-probe-core/src/main/java CVE-2026-327005.3Devise is an authentication solution for Rails based on Warden. Prior to version 5.0.3, a race condition in Devise's Confirmable module allo