CVE-2026-87755

Apache TomEE is vulnerable to stateful session bean hijacking because identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint and one valid identifier can derive identifiers for other clients' sessions. This allows the ...

CVE-2026-87755 Apache TomEE: Stateful session bean hijacking via predictable session identifiers

Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other...

CVE-2026-11730: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access such as WiFi credentials to predict valid session identifiers and hijack an authenticated administrator session on the web management portal...

EUVD-2026-91821

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as oth...

CVE-2026-97212

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as oth...

CVE-2026-97212

The Monta monta.app software is affected by a vulnerability in its WebSocket backend . The system uses charging station identifiers to associate sessions but incorrectly allows multiple endpoints to connect using the same session identifier, leading to predictable session identifiers . This flaw ...

Linux Distros Unpatched Vulnerability : CVE-2026-38968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak...

CVE-2026-38968

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding...

CVE-2026-38968

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding...

CVE-2026-38968

The ntopng network monitoring tool (versions through 6.6 ) is vulnerable to Predictable Session Identifiers , which can lead to Session Hijacking . The root cause is located in src/HTTPserver.cpp, where the application uses weak time-seeded pseudo-randomness to generate HTTP session identifiers. ...

CVE-2026-38968

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding...

CVE-2026-54479: Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as oth...

Netatalk Security Feature Vulnerability

Netatalk is an open-source software developed by Netatalk Inc. It provides AFP file server functionality for Classic Mac OS and macOS on Unix-like operating systems. Versions 2.0.0 to 4.4.2 of Netatalk contained security vulnerabilities. These vulnerabilities stemmed from the generation of...

CVE-2026-5084

WebDyne::Session versions before 3.003704 for Perl generate the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand function. The rand function is passed a maximum value based on the process id, the epoch time and the...

CTEK Chargeportal code-related vulnerabilities

CTEK Chargeportal is an electric vehicle charging management platform developed by the Swedish company CTEK. CTEK Chargeportal has code-related vulnerabilities; these vulnerabilities stem from the predictable nature of session identifiers and the ability for multiple endpoints to use the same...

CVE-2026-25072

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint that allows remote attackers to hijack authenticated sessions. Attackers can predict session identifiers using insufficiently random cook...

CVE-2026-25072 XikeStor SKS8310-8X Predictable Session Identifiers

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint that allows remote attackers to hijack authenticated sessions. Attackers can predict session identifiers using insufficiently random cook...

CVE-2026-25072 XikeStor SKS8310-8X Predictable Session Identifiers

XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier vulnerability in the /goform/SetLogin endpoint that allows remote attackers to hijack authenticated sessions. Attackers can predict session identifiers using insufficiently random cook...

PT-2026-23711

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The WebSocket backend uses charging station identifiers to associate sessions, but allows multiple endpoints to connect using the same session identifier. This results in predictable session...

ePower code issue vulnerabilities

ePower is an electric vehicle charging station system owned by the Irish company ePower. ePower has a code vulnerability that stems from the predictable nature of session identifiers and the ability for multiple endpoints to use the same identifier to connect, which may lead to session hijacking ...