https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T18:24:49.833319+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-322913 EUVD-2026-322913 2026-10-05T18:24:49.883588+00:00 EUVD-2026-322913 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33384 fkie_cve-2026-33384 2026-10-05T18:24:49.883632+00:00

QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session.

This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.

 https://cve.radiocsirt.org/vuln/ghsa-x6p9-8crm-x3hf GHSA-x6p9-8crm-x3hf 2026-10-05T18:24:49.883670+00:00

QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session.

This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.