https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:33:45 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-05021 bdu:2026-05021 https://cve.radiocsirt.org/vuln/bdu:2026-05021 https://cve.radiocsirt.org/vuln/euvd-2026-281263 EUVD-2026-281263 https://cve.radiocsirt.org/vuln/euvd-2026-281263 https://cve.radiocsirt.org/vuln/fkie_cve-2026-1163 <p>An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.</p> <p>An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-1163 https://cve.radiocsirt.org/vuln/ghsa-8jg2-726g-xh43 <p><strong>Affected:</strong> PyPI: lollms</p> <p>An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.</p> <p><strong>Affected:</strong> PyPI: lollms</p> <p>An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.</p> https://cve.radiocsirt.org/vuln/ghsa-8jg2-726g-xh43 https://cve.radiocsirt.org/vuln/pysec-2026-2612 <p><strong>Affected:</strong> PyPI: lollms</p> <p>An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.</p> <p><strong>Affected:</strong> PyPI: lollms</p> <p>An insufficient session expiration vulnerability exists in the latest version of parisneo/lollms. The application fails to invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This issue arises due to the absence of logic to reject requests after a period of inactivity and the excessively long default session duration of 31 days. The vulnerability enables an attacker to maintain persistent access to a compromised account, even after the victim resets their password.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2612