Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 16:19:50 +0000 cnvd-2021-103365 https://cve.radiocsirt.org/vuln/cnvd-2021-103365 cnvd-2021-103365 https://cve.radiocsirt.org/vuln/cnvd-2021-103365 EUVD-2026-236007 https://cve.radiocsirt.org/vuln/euvd-2026-236007 EUVD-2026-236007 https://cve.radiocsirt.org/vuln/euvd-2026-236007 fkie_cve-2021-25979 https://cve.radiocsirt.org/vuln/fkie_cve-2021-25979 <p>Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.</p> <p>Apostrophe CMS versions prior to 3.3.1 did not invalidate existing login sessions when disabling a user account or changing the password, creating a situation in which a device compromised by a third party could not be locked out by those means. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-25979 GHSA-9j9m-8wjc-ff96 — Apostrophe CMS Insufficient Session Expiration vulnerability https://cve.radiocsirt.org/vuln/ghsa-9j9m-8wjc-ff96 <p><strong>Affected:</strong> npm: apostrophe</p> <p>Apostrophe CMS versions between 2.63.0 to 3.3.1 affected by an insufficient session expiration vulnerability, which allows unauthenticated remote attackers to hijack recently logged-in users&#39; sessions. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.</p> <p><strong>Affected:</strong> npm: apostrophe</p> <p>Apostrophe CMS versions between 2.63.0 to 3.3.1 affected by an insufficient session expiration vulnerability, which allows unauthenticated remote attackers to hijack recently logged-in users&#39; sessions. As a mitigation for older releases the user account in question can be archived (3.x) or moved to the trash (2.x and earlier) which does disable the existing session.</p> https://cve.radiocsirt.org/vuln/ghsa-9j9m-8wjc-ff96 gsd-2021-25979 https://cve.radiocsirt.org/vuln/gsd-2021-25979 gsd-2021-25979 https://cve.radiocsirt.org/vuln/gsd-2021-25979