agentprime: CWE-1004

CVE-2026-78188: WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes

Sat, 31 Oct 2026 14:33:37 GMT

Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-115519: Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

Thu, 22 Oct 2026 18:18:33 GMT

CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

AIOHTTP: Secure attribute not enforced for shared cookie

Mon, 19 Oct 2026 17:07:47 GMT

aiohttp <3.14.4, fixed in 3.14.4. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-82697: sambitraj Student-Management-System session_start cookie httponly flag

Mon, 31 Aug 2026 13:15:09 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-21754: HCL Hive is affected by multiple security vulnerabilities.

Tue, 25 Aug 2026 10:51:48 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

OpenAM Insecure SSO Cookie Initialization

Fri, 14 Aug 2026 19:25:57 GMT

org.openidentityplatform.openam:openam-core <16.1.1, fixed in 16.1.1. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-57948: Pinpoint - Insecure Session Cookie Attributes in pinpointJwt

Mon, 29 Jun 2026 17:19:11 GMT

CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-11956: TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute

Thu, 11 Jun 2026 11:30:12 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

Fri, 24 Apr 2026 16:18:52 GMT

@budibase/backend-core <3.35.10, fixed in 3.35.10. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-39338: ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration

Tue, 07 Apr 2026 17:57:30 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-35575: ChurchCRM has Stored XSS in Group Name

Tue, 07 Apr 2026 17:08:43 GMT

CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute

Wed, 25 Feb 2026 19:37:27 GMT

rucio-webui <35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1, fixed in 35.8.3, 38.5.4, 39.3.1. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name

Wed, 25 Feb 2026 19:29:37 GMT

rucio-webui <35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1, fixed in 35.8.3, 38.5.4, 39.3.1. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

Wed, 25 Feb 2026 19:29:22 GMT

rucio-webui <35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1, fixed in 35.8.3, 38.5.4, 39.3.1. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function

Wed, 25 Feb 2026 18:58:20 GMT

rucio-webui <35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1, fixed in 35.8.3, 38.5.4, 39.3.1. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Rucio WebUI has a Reflected Cross-site Scripting Vulnerability

Wed, 25 Feb 2026 18:53:29 GMT

rucio-webui <35.8.3 || >=36.0.0rc1, <38.5.4 || >=39.0.0rc1, <39.3.1, fixed in 35.8.3, 38.5.4, 39.3.1. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-0696: Session Cookies Missing HttpOnly Attribute

Fri, 16 Jan 2026 13:34:49 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-22081: Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers

Fri, 09 Jan 2026 11:16:21 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-27223: TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList.

Mon, 27 Oct 2025 00:00:00 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-12031: HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute

Tue, 21 Oct 2025 17:22:36 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-42909: Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances

Tue, 14 Oct 2025 00:18:11 GMT

CVSS 3.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-57424: A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field.

Mon, 29 Sep 2025 00:00:00 GMT

CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-53757: Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router

Wed, 16 Jul 2025 11:25:05 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-27453: CVE-2025-27453

Thu, 03 Jul 2025 11:29:48 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-49189: Cookie missing HttpOnly flag

Thu, 12 Jun 2025 14:03:39 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-47289: Stored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly Flag

Mon, 02 Jun 2025 11:00:20 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-26844: An issue was discovered in Znuny through 7.1.3.

Thu, 08 May 2025 00:00:00 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-24318: Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flag

Fri, 28 Feb 2025 17:09:05 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-0479: Security Misconfiguration Vulnerability in CP Plus Router

Mon, 20 Jan 2025 11:37:13 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2022-43845: IBM Aspera Console information disclosure

Tue, 24 Sep 2024 10:11:00 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Taipy has a Session Cookie without Secure and HTTPOnly flags

Tue, 27 Aug 2024 19:50:59 GMT

taipy <4.0.0, fixed in 4.0.0. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2022-33167: IBM Security Directory Integrator information disclosure

Tue, 30 Jul 2024 17:05:35 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-41685: Cookie Without HTTPOnly Flag Set Vulnerability

Fri, 26 Jul 2024 11:41:53 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-6739: Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag

Mon, 15 Jul 2024 03:15:03 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

TYPO3 Security Misconfiguration in Install Tool Cookie

Fri, 07 Jun 2024 19:52:43 GMT

typo3/cms >=7.0.0, <7.6.32 || >=8.0.0, <8.7.21 || >=9.0.0, <9.5.2, fixed in 7.6.32, 8.7.21, 9.5.2. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

TYPO3 Security Misconfiguration in Install Tool Cookie

Thu, 30 May 2024 15:11:42 GMT

typo3/cms-core >=7.0.0, <7.6.32 || >=8.0.0, <8.7.21 || >=9.0.0, <9.5.2, fixed in 7.6.32, 8.7.21, 9.5.2. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2023-4217: Session cookies attribute not set properly

Thu, 02 Nov 2023 16:04:29 GMT

CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-4228: ioLogik 4000 Series: Session Cookies Attribute Not Set Properly

Thu, 24 Aug 2023 06:19:40 GMT

CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-2876: Session cookie exposure for client side script

Tue, 13 Jun 2023 03:52:12 GMT

CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2022-21939: Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)

Thu, 09 Feb 2023 20:49:17 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

nsupdate.info has Sensitive Cookie Without 'HttpOnly' Flag

Wed, 28 Dec 2022 00:30:22 GMT

nsupdate <=0.12.0, no fixed version yet. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2022-4630: Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradius

Wed, 21 Dec 2022 00:00:00 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header

Sat, 14 May 2022 02:42:23 GMT

org.apache.tomcat:tomcat >=6.0.0, <6.0.35, fixed in 6.0.35. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2022-25172: InHand Networks InRouter302: An information disclosure vulnerability exists in the web interface session cookie…

Thu, 12 May 2022 17:01:34 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2021-42115: Missing HTTPOnly flag on sensitive cookie in TopEase

Tue, 30 Nov 2021 11:28:07 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2021-39210: Autologin cookie accessible by scripts

Wed, 15 Sep 2021 16:40:11 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2021-3706: Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte

Wed, 15 Sep 2021 06:30:13 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2021-34563: In WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify it

Tue, 31 Aug 2021 10:32:58 GMT

CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2020-27658: Synology Router Manager (SRM): Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a…

Thu, 29 Oct 2020 08:55:23 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2020-6267: SAP SE SAP Disclosure Management: Some sensitive cookies in SAP Disclosure Management, version 10.1…

Tue, 14 Jul 2020 12:30:14 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.