CVE-2026-45336

HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2 and earlier, app.py assigns a hard-coded Flask secretkey used to sign session cookies, allowing unauthenticated attackers who know the public source value to...

CVE-2026-61500

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's...

CVE-2026-61500

Rejetto HFS versions 3.0.0 through 3.2.0 are vulnerable to an unauthenticated session-forgery attack. The root cause is the use of a non-cryptographic Math.random() generator to derive the session-cookie signing key, while simultaneously disclosing generator outputs to unauthenticated clients dur...

PT-2026-57841

Name of the Vulnerable Software and Affected Versions Rejetto HFS versions 3.0.0 through 3.2.0 Description Rejetto HFS uses a non-cryptographic pseudo-random number generator, Math.random, to derive its session-cookie signing key. The application discloses outputs from this same generator to...

CVE-2026-2336

A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstaxauth session cookie and forge a new cookie with administrative privileges.This issue affects IStaX before 2026.03...