https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:14:00 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-15028 bdu:2026-15028 https://cve.radiocsirt.org/vuln/bdu:2026-15028 https://cve.radiocsirt.org/vuln/euvd-2026-370739 EUVD-2026-370739 https://cve.radiocsirt.org/vuln/euvd-2026-370739 https://cve.radiocsirt.org/vuln/fkie_cve-2026-77614 <p>Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim&#39;s authenticated session. This can expose the victim&#39;s data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.</p> <p>Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim&#39;s authenticated session. This can expose the victim&#39;s data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-77614