https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T20:51:07.343533+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-111259 CVE-2026-111259 — Apache TomEE: Predictable HTTP session identifiers in embedded server 2026-11-10T20:51:07.346264+00:00

Affected: Apache Software Foundation Apache TomEE

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.