urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure

A flaw was found in the urwid web display backend. This vulnerability arises from the use of a cryptographically insecure pseudo-random number generator PRNG for web session identifiers, making them predictable. An attacker could either observe enough session IDs to reconstruct the PRNG state or,...

urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure

A flaw was found in the urwid web display backend. This vulnerability arises from the use of a cryptographically insecure pseudo-random number generator PRNG for web session identifiers, making them predictable. An attacker could either observe enough session IDs to reconstruct the PRNG state or,...

Important: Red Hat Security Advisory: python-urwid security update

An update for python-urwid is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

CVE-2026-78168

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpconchecksessionurl of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed...

CVE-2026-78167

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpconchecksessionurl of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made availab...

EUVD-2026-64690

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpconchecksessionurl of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed...

CVE-2026-78168

EFM ipTIME T24000M routers running firmware up to 14.20.0 are affected by an improper authentication vulnerability in the function httpcon_check_session_url within the Session Validation Handler . The flaw allows a remote, unauthenticated attacker to bypass session validation without user interac...

CVE-2026-78168 EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpconchecksessionurl of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed...

CVE-2026-78168 EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication

A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpconchecksessionurl of the component Session Validation Handler. Such manipulation leads to improper authentication. The attack can be executed remotely. The exploit has been disclosed...

EUVD-2026-64687

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpconchecksessionurl of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made availab...

CVE-2026-78167

EFM ipTIME T16000M (firmware 14.20.2 ) contains an improper authentication vulnerability in the httpcon_check_session_url function of the Session Validation Handler . The flaw allows remote exploitation over the network with no privileges required and low complexity , rated CVSS 4.0: 10.0 (CRITIC...

CVE-2026-78167 EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpconchecksessionurl of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made availab...

CVE-2026-78167 EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpconchecksessionurl of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made availab...

CVE-2026-78553: Incorrect Default Permissions

RansomLook created its Flask session-signing key without explicitly restricting the file permissions. The secretkey file was created using the process's default permissions and umask, resulting in permissions such as 0644 under a common 022 umask. Consequently, other local users able to access th...

PT-2026-81026

Name of the Vulnerable Software and Affected Versions hex.pm versions 2025-10-10 through 2026-08-23 Description An insufficient session expiration issue exists in the OAuth token refresh grant. The expand repositories scope/3 function in lib/hexpm/permissions.ex only rewrites the literal...

CVE-2026-78167: Improper Authentication

A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpconchecksessionurl of the component Session Validation Handler. This manipulation causes improper authentication. Remote exploitation of the attack is possible. The exploit has been made availab...

RockyLinux 8 : python-urwid (RLSA-2026:58562)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58562 advisory. urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure CVE-2026-9323 Tenable has extracted the preceding description bloc...

RHEL 9 : python-urwid (RHSA-2026:58955)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58955 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RockyLinux 10 : python-urwid (RLSA-2026:58561)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58561 advisory. urwid: Urwid: Predictable session IDs lead to remote code execution and information disclosure CVE-2026-9323 Tenable has extracted the preceding description blo...

RHEL 8 : python-urwid (RHSA-2026:58562)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58562 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...