# CWE-1004.

Every Advisory and CVE whose sources give the weakness CWE-1004, newest first.

## Records, newest first

- [WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes](https://agentprime.io/advisories/CVE-2026-78188.md)
  `CVE-2026-78188` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: CWE-614, CWE-1004, CWE-1275
- [Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub](https://agentprime.io/advisories/CVE-2026-115519.md)
  `CVE-2026-115519` · CVE record: KNIME KNIME Business Hub · CVSS 2.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-614, CWE-1004
- [AIOHTTP: Secure attribute not enforced for shared cookie](https://agentprime.io/advisories/GHSA-494j-54xm-rwp3.md)
  `GHSA-494j-54xm-rwp3`, `CVE-2026-111063` · PyPI `aiohttp`: affected `<3.14.4`, fixed in `3.14.4` · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Weak cryptography or TLS, CWE-1004
- [sambitraj Student-Management-System session_start cookie httponly flag](https://agentprime.io/advisories/CVE-2026-82697.md)
  `CVE-2026-82697` · CVE record: sambitraj Student-Management-System · CVSS 6.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Broken access control, CWE-1004
- [HCL Hive is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-21754.md)
  `CVE-2026-21754` · CVE record: HCL Software Hive · CVSS 5.4 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-1004
- [OpenAM Insecure SSO Cookie Initialization](https://agentprime.io/advisories/GHSA-fpmh-vx4h-xc33.md)
  `GHSA-fpmh-vx4h-xc33`, `CVE-2026-53660` · Maven `org.openidentityplatform.openam:openam-core`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.4 High · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-1004, CWE-1188, CWE-1275
- [Pinpoint - Insecure Session Cookie Attributes in pinpointJwt](https://agentprime.io/advisories/CVE-2026-57948.md)
  `CVE-2026-57948` · CVE record: pinpoint-apm pinpoint · CVSS 7.6 High · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-614, CWE-1004
- [TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute](https://agentprime.io/advisories/CVE-2026-11956.md)
  `CVE-2026-11956` · CVE record: TwiN gatus · CVSS 6.3 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-614, CWE-1004
- [Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover](https://agentprime.io/advisories/GHSA-4f9j-vr4p-642r.md)
  `GHSA-4f9j-vr4p-642r`, `CVE-2026-42239` · npm `@budibase/backend-core`: affected `<3.35.10`, fixed in `3.35.10` · CVSS 8.1 High · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-1004
- [ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration](https://agentprime.io/advisories/CVE-2026-39338.md)
  `CVE-2026-39338` · CVE record: ChurchCRM CRM · CVSS 8.6 High · Not analysed yet · Published 7 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-1004
- [ChurchCRM has Stored XSS in Group Name](https://agentprime.io/advisories/CVE-2026-35575.md)
  `CVE-2026-35575` · CVE record: ChurchCRM CRM · CVSS 8.0 High · Not analysed yet · Published 7 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-1004
- [Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute](https://agentprime.io/advisories/GHSA-fq4f-4738-rqxm.md)
  `GHSA-fq4f-4738-rqxm`, `CVE-2026-25736`, `PYSEC-2026-3055` · PyPI `rucio-webui`: affected `<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1`, fixed in `35.8.3`, `38.5.4`, `39.3.1` · CVSS 6.1 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-1004
- [Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name](https://agentprime.io/advisories/GHSA-8wpv-6x3f-3rm5.md)
  `GHSA-8wpv-6x3f-3rm5`, `CVE-2026-25735`, `PYSEC-2026-3054` · PyPI `rucio-webui`: affected `<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1`, fixed in `35.8.3`, `38.5.4`, `39.3.1` · CVSS 6.1 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-1004
- [Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata](https://agentprime.io/advisories/GHSA-h9fp-p2p9-873q.md)
  `GHSA-h9fp-p2p9-873q`, `CVE-2026-25734`, `PYSEC-2026-3057` · PyPI `rucio-webui`: affected `<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1`, fixed in `35.8.3`, `38.5.4`, `39.3.1` · CVSS 6.1 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-1004
- [Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function](https://agentprime.io/advisories/GHSA-rwj9-7j48-9f7q.md)
  `GHSA-rwj9-7j48-9f7q`, `CVE-2026-25733`, `PYSEC-2026-3058` · PyPI `rucio-webui`: affected `<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1`, fixed in `35.8.3`, `38.5.4`, `39.3.1` · CVSS 7.3 High · Not analysed yet · Published 25 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-1004
- [Rucio WebUI has a Reflected Cross-site Scripting Vulnerability](https://agentprime.io/advisories/GHSA-h79m-5jjm-jm4q.md)
  `GHSA-h79m-5jjm-jm4q`, `CVE-2026-25136`, `PYSEC-2026-3056` · PyPI `rucio-webui`: affected `<35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1`, fixed in `35.8.3`, `38.5.4`, `39.3.1` · CVSS 8.1 High · Not analysed yet · Published 25 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-1004
- [Session Cookies Missing HttpOnly Attribute](https://agentprime.io/advisories/CVE-2026-0696.md)
  `CVE-2026-0696` · CVE record: ConnectWise PSA · CVSS 6.5 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: CWE-1004
- [Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers](https://agentprime.io/advisories/CVE-2026-22081.md)
  `CVE-2026-22081` · CVE record: Tenda 300Mbps Wireless Router F3 and N300 Easy Setup Router · CVSS 8.8 High · Not analysed yet · Published 9 Jan 2026 · Tags: CWE-1004
- [TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList.](https://agentprime.io/advisories/CVE-2025-27223.md)
  `CVE-2025-27223` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-1004
- [HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute](https://agentprime.io/advisories/CVE-2025-12031.md)
  `CVE-2025-12031` · CVE record: Azure Access Technology BLU-IC2 and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: CWE-1004
- [Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances](https://agentprime.io/advisories/CVE-2025-42909.md)
  `CVE-2025-42909` · CVE record: SAP_SE SAP Cloud Appliance Library Appliances · CVSS 3.0 Low · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-1004
- [A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field.](https://agentprime.io/advisories/CVE-2025-57424.md)
  `CVE-2025-57424` · CVE record · CVSS 7.3 High · Not analysed yet · Published 29 Sept 2025 · Tags: Cross-site scripting (XSS), CWE-1004
- [Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router](https://agentprime.io/advisories/CVE-2025-53757.md)
  `CVE-2025-53757` · CVE record: Digisol XPON ONU Wi-Fi Router (DG-GR6821AC) · CVSS 8.7 High · Not analysed yet · Published 16 Jul 2025 · Tags: CWE-614, CWE-1004
- [CVE-2025-27453](https://agentprime.io/advisories/CVE-2025-27453.md)
  `CVE-2025-27453` · CVE record: Endress+Hauser Endress+Hauser MEAC300-FNADE4 · CVSS 5.3 Medium · Not analysed yet · Published 3 Jul 2025 · Tags: CWE-1004
- [Cookie missing HttpOnly flag](https://agentprime.io/advisories/CVE-2025-49189.md)
  `CVE-2025-49189` · CVE record: SICK AG SICK Media Server · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2025 · Tags: CWE-1004
- [Stored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly Flag](https://agentprime.io/advisories/CVE-2025-47289.md)
  `CVE-2025-47289` · CVE record: CE-PhoenixCart PhoenixCart · CVSS 6.3 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: CWE-1004
- [An issue was discovered in Znuny through 7.1.3.](https://agentprime.io/advisories/CVE-2025-26844.md)
  `CVE-2025-26844` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2025 · Tags: CWE-1004
- [Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flag](https://agentprime.io/advisories/CVE-2025-24318.md)
  `CVE-2025-24318` · CVE record: Dario Health Dario Application Database and Internet-based Server Infrastructure · CVSS 5.9 Medium · Not analysed yet · Published 28 Feb 2025 · Tags: CWE-1004
- [Security Misconfiguration Vulnerability in CP Plus Router](https://agentprime.io/advisories/CVE-2025-0479.md)
  `CVE-2025-0479` · CVE record: CP Plus CP-XR-DE21-S Router · CVSS 8.6 High · Not analysed yet · Published 20 Jan 2025 · Tags: CWE-614, CWE-1004
- [IBM Aspera Console information disclosure](https://agentprime.io/advisories/CVE-2022-43845.md)
  `CVE-2022-43845` · CVE record: IBM Aspera Console · CVSS 3.7 Low · Not analysed yet · Published 24 Sept 2024 · Tags: CWE-1004
- [Taipy has a Session Cookie without Secure and HTTPOnly flags](https://agentprime.io/advisories/GHSA-r3jq-4r5c-j9hp.md)
  `GHSA-r3jq-4r5c-j9hp`, `CVE-2024-47833`, `PYSEC-2024-168` · PyPI `taipy`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 6.3 Medium · Not analysed yet · Published 27 Aug 2024 · Tags: Weak cryptography or TLS, CWE-614, CWE-1004
- [IBM Security Directory Integrator information disclosure](https://agentprime.io/advisories/CVE-2022-33167.md)
  `CVE-2022-33167` · CVE record: IBM Security Directory Integrator and 1 more · CVSS 3.7 Low · Not analysed yet · Published 30 Jul 2024 · Tags: CWE-1004
- [Cookie Without HTTPOnly Flag Set Vulnerability](https://agentprime.io/advisories/CVE-2024-41685.md)
  `CVE-2024-41685` · CVE record: SyroTech SyroTech SY-GPON-1110-WDONT router · CVSS 6.9 Medium · Not analysed yet · Published 26 Jul 2024 · Tags: CWE-1004
- [Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag](https://agentprime.io/advisories/CVE-2024-6739.md)
  `CVE-2024-6739` · CVE record: Openfind MailGates and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 15 Jul 2024 · Tags: CWE-1004
- [TYPO3 Security Misconfiguration in Install Tool Cookie](https://agentprime.io/advisories/GHSA-f777-f784-36gm.md)
  `GHSA-f777-f784-36gm`, `PKSA-b9qm-1gk1-gg53` · Packagist `typo3/cms`: affected `>=7.0.0, <7.6.32 || >=8.0.0, <8.7.21 || >=9.0.0, <9.5.2`, fixed in `7.6.32`, `8.7.21`, `9.5.2` · CVSS 8.1 High · Not analysed yet · Published 7 Jun 2024 · Tags: CWE-1004
- [TYPO3 Security Misconfiguration in Install Tool Cookie](https://agentprime.io/advisories/GHSA-ppvg-hw62-6ph9.md)
  `GHSA-ppvg-hw62-6ph9`, `PKSA-yzt1-7625-ng3j` · Packagist `typo3/cms-core`: affected `>=7.0.0, <7.6.32 || >=8.0.0, <8.7.21 || >=9.0.0, <9.5.2`, fixed in `7.6.32`, `8.7.21`, `9.5.2` · CVSS 7.5 High · Not analysed yet · Published 30 May 2024 · Tags: CWE-1004
- [Session cookies attribute not set properly](https://agentprime.io/advisories/CVE-2023-4217.md)
  `CVE-2023-4217` · CVE record: Moxa PT-G503 Series · CVSS 3.1 Low · Not analysed yet · Published 2 Nov 2023 · Tags: CWE-1004
- [ioLogik 4000 Series: Session Cookies Attribute Not Set Properly](https://agentprime.io/advisories/CVE-2023-4228.md)
  `CVE-2023-4228` · CVE record: Moxa ioLogik 4000 Series · CVSS 3.1 Low · Not analysed yet · Published 24 Aug 2023 · Tags: CWE-1004
- [Session cookie exposure for client side script](https://agentprime.io/advisories/CVE-2023-2876.md)
  `CVE-2023-2876` · CVE record: ABB REX640 PCL1 and 2 more · CVSS 3.1 Low · Not analysed yet · Published 13 Jun 2023 · Tags: CWE-1004
- [Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)](https://agentprime.io/advisories/CVE-2022-21939.md)
  `CVE-2022-21939` · CVE record: Johnson Controls System Configuration Tool (SCT) · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2023 · Tags: CWE-1004
- [nsupdate.info has Sensitive Cookie Without 'HttpOnly' Flag](https://agentprime.io/advisories/GHSA-mwvp-qr62-cvjx.md)
  `GHSA-mwvp-qr62-cvjx`, `CVE-2019-25091`, `PYSEC-2026-885` · PyPI `nsupdate`: affected `<=0.12.0`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 28 Dec 2022 · Tags: CWE-1004
- [Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradius](https://agentprime.io/advisories/CVE-2022-4630.md)
  `CVE-2022-4630` · CVE record: lirantal lirantal/daloradius · CVSS 5.3 Medium · Not analysed yet · Published 21 Dec 2022 · Tags: CWE-1004
- [Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header](https://agentprime.io/advisories/GHSA-pvjh-7h8q-q56r.md)
  `GHSA-pvjh-7h8q-q56r`, `CVE-2010-4312` · Maven `org.apache.tomcat:tomcat`: affected `>=6.0.0, <6.0.35`, fixed in `6.0.35` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: CWE-1004
- [InHand Networks InRouter302: An information disclosure vulnerability exists in the web interface session cookie…](https://agentprime.io/advisories/CVE-2022-25172.md)
  `CVE-2022-25172` · CVE record: InHand Networks InRouter302 · CVSS 7.5 High · Not analysed yet · Published 12 May 2022 · Tags: CWE-1004
- [Missing HTTPOnly flag on sensitive cookie in TopEase](https://agentprime.io/advisories/CVE-2021-42115.md)
  `CVE-2021-42115` · CVE record: Business-DNA Solutions GmbH TopEase · CVSS 8.1 High · Not analysed yet · Published 30 Nov 2021 · Tags: CWE-1004
- [Autologin cookie accessible by scripts](https://agentprime.io/advisories/CVE-2021-39210.md)
  `CVE-2021-39210` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 15 Sept 2021 · Tags: CWE-1004
- [Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte](https://agentprime.io/advisories/CVE-2021-3706.md)
  `CVE-2021-3706` · CVE record: pi-hole pi-hole/adminlte · CVSS 7.4 High · Not analysed yet · Published 15 Sept 2021 · Tags: CWE-1004
- [In WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify it](https://agentprime.io/advisories/CVE-2021-34563.md)
  `CVE-2021-34563` · CVE record: Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH and 1 more · CVSS 3.3 Low · Not analysed yet · Published 31 Aug 2021 · Tags: CWE-1004
- [Synology Router Manager (SRM): Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a…](https://agentprime.io/advisories/CVE-2020-27658.md)
  `CVE-2020-27658` · CVE record: Synology Synology Router Manager (SRM) · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2020 · Tags: CWE-1004
- [SAP SE SAP Disclosure Management: Some sensitive cookies in SAP Disclosure Management, version 10.1…](https://agentprime.io/advisories/CVE-2020-6267.md)
  `CVE-2020-6267` · CVE record: SAP SE SAP Disclosure Management · CVSS 6.3 Medium · Not analysed yet · Published 14 Jul 2020 · Tags: CWE-1004
- [Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag.](https://agentprime.io/advisories/CVE-2019-8283.md)
  `CVE-2019-8283` · CVE record: Sentinel LDK RTE · No CVSS score · Not analysed yet · Published 7 Jun 2019 · Tags: CWE-1004

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1004>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1004/>. Everything for agents: <https://agentprime.io/llms.txt>.