https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T02:07:01.389516+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-292158 EUVD-2026-292158 2026-10-06T02:07:01.392199+00:00 EUVD-2026-292158 https://cve.radiocsirt.org/vuln/fkie_cve-2025-40931 fkie_cve-2025-40931 2026-10-06T02:07:01.392231+00:00

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.

Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

Note that the libapache-session-perl package in some Debian-based Linux distributions may be patched to use Crypt::URandom.

 https://cve.radiocsirt.org/vuln/ghsa-32fg-c88m-mcrv GHSA-32fg-c88m-mcrv 2026-10-06T02:07:01.392266+00:00

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id.

Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-40931 UBUNTU-CVE-2025-40931 2026-10-06T02:07:01.392286+00:00

Affected: Ubuntu:16.04:LTS: libapache-session-perl, Ubuntu:18.04:LTS: libapache-session-perl, Ubuntu:20.04:LTS: libapache-session-perl, Ubuntu:22.04:LTS: libapache-session-perl, Ubuntu:24.04:LTS: libapache-session-perl, Ubuntu:25.10: libapache-session-perl, Ubuntu:26.04:LTS: libapache-session-perl

Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Note that the libapache-session-perl package in some Debian-based Linux distributions may be patched to use Crypt::URandom.