Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:18:49 +0000 EUVD-2026-365608 https://cve.radiocsirt.org/vuln/euvd-2026-365608 EUVD-2026-365608 https://cve.radiocsirt.org/vuln/euvd-2026-365608 fkie_cve-2026-64857 https://cve.radiocsirt.org/vuln/fkie_cve-2026-64857 <p>tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user&#39;s credentials and establishes the authenticated session, but it does not call `session_regenerate_id()` afterward. As a result, the session identifier is not rotated on login, it stays the same before and after authentication. An attacker able to fix a known session identifier in a victim&#39;s browser (for example through a network man-in-the-middle position, or a separate cross-site scripting or subdomain cookie-injection issue) could then gain access to the victim&#39;s authenticated session. The issue is fixed in v0.10.0. The session identifier is now regenerated on successful authentication, and the previous session is destroyed. There is no configuration-level workaround.</p> <p>tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user&#39;s credentials and establishes the authenticated session, but it does not call `session_regenerate_id()` afterward. As a result, the session identifier is not rotated on login, it stays the same before and after authentication. An attacker able to fix a known session identifier in a victim&#39;s browser (for example through a network man-in-the-middle position, or a separate cross-site scripting or subdomain cookie-injection issue) could then gain access to the victim&#39;s authenticated session. The issue is fixed in v0.10.0. The session identifier is now regenerated on successful authentication, and the previous session is destroyed. There is no configuration-level workaround.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-64857