agentprime: CWE-565

CVE-2026-119128: ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

Thu, 29 Oct 2026 15:58:10 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

Wed, 28 Oct 2026 21:06:13 GMT

happy-dom <20.14.6, fixed in 20.14.6. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-112352: Sunhillo SureLine Authentication Bypass via Session Cookie

Tue, 27 Oct 2026 19:43:34 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

Tue, 20 Oct 2026 19:58:14 GMT

aiohttp <3.14.4, fixed in 3.14.4. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-101287: Authentication bypass in Stela by Diaple Networking

Thu, 15 Oct 2026 09:00:07 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

Wed, 16 Sep 2026 09:09:57 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

Tue, 15 Sep 2026 20:00:54 GMT

org.http4s:http4s-client_2.12 <0.23.35, fixed in 0.23.35. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Tue, 15 Sep 2026 20:00:43 GMT

org.http4s:http4s-client_2.12 <0.23.35, fixed in 0.23.35. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-85181: CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

Thu, 03 Sep 2026 14:12:19 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

Mon, 31 Aug 2026 02:20:17 GMT

ash_admin >=0.9.1, <1.3.1, fixed in 1.3.1. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-53871: Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie

Wed, 17 Jun 2026 17:58:29 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

Concrete CMS is vulnerable to IDOR in surveys

Fri, 22 May 2026 00:31:17 GMT

concrete5/concrete5 <9.5.1, fixed in 9.5.1. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-0257: PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

Wed, 13 May 2026 18:15:10 GMT

CVSS 7.8 (High). Critical: In CISA’s KEV catalogue since 29 May 2026: it is known to be exploited. CVSS score 7.8 (7.0 or more) and EPSS 0.96 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.

Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php

Tue, 14 Apr 2026 22:32:29 GMT

s9y/serendipity <2.6.0, fixed in 2.6.0. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

Wed, 08 Apr 2026 00:15:08 GMT

rack-session >=2.0.0, <2.1.2, fixed in 2.1.2. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-5130: Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation

Mon, 30 Mar 2026 22:24:59 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2014-125112: Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution

Thu, 26 Mar 2026 02:04:10 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2022-50926: WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation

Tue, 13 Jan 2026 22:51:57 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-65212: An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1.

Tue, 06 Jan 2026 00:00:00 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-14440: JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie

Sat, 13 Dec 2025 04:31:30 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2021-47706: COMMAX Biometric Access Control System Authentication Bypass

Tue, 09 Dec 2025 20:37:44 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-64447: Fortinet FortiWeb: A reliance on cookies without validation and integrity checking vulnerability in Fortinet…

Tue, 09 Dec 2025 17:18:42 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-48980: In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie attribute.

Thu, 30 Oct 2025 23:29:44 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-59247: Azure PlayFab Elevation of Privilege Vulnerability

Thu, 09 Oct 2025 21:04:10 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-31120: NamelessMC Vulnerable to Cookie-Based View Count Manipulation

Fri, 18 Apr 2025 15:52:57 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-55211: An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.

Thu, 17 Apr 2025 00:00:00 GMT

CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-2395: e-Excellence U-Office Force - Improper Authentication

Mon, 17 Mar 2025 05:51:02 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-9970: NewType FlowMaster BPM Plus - Privilege Escalation

Tue, 15 Oct 2024 03:36:15 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

github.com/gitpod-io/gitpod vulnerable to Cookie Tossing

Fri, 19 Jul 2024 06:31:13 GMT

github.com/gitpod-io/gitpod <=0.8.0, no fixed version yet. CVSS 4.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-0947: Cookies Manipulation in Talya Informatics' Elektraweb

Thu, 27 Jun 2024 09:27:41 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2021-20450: IBM Cognos Controller information disclosure

Fri, 03 May 2024 16:55:57 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-21872: Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

Thu, 18 Apr 2024 22:10:42 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-22186: Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

Thu, 18 Apr 2024 22:08:17 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-28288: Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability.

Sat, 30 Mar 2024 00:00:00 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing

Thu, 28 Mar 2024 17:08:10 GMT

jupyterhub <4.1.0, fixed in 4.1.0. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-1551: Set-Cookie response headers were being incorrectly honored in multipart HTTP responses.

Tue, 20 Feb 2024 13:21:36 GMT

CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-32725: Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.

Mon, 18 Dec 2023 09:15:23 GMT

CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CSRF token reuse vulnerability in github.com/gofiber/fiber/v2

Tue, 24 Oct 2023 16:57:01 GMT

github.com/gofiber/fiber/v2 <2.50.0, fixed in 2.50.0. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Go Fiber CSRF Token Validation Vulnerability

Tue, 17 Oct 2023 12:41:07 GMT

github.com/gofiber/fiber/v2 <2.50.0, fixed in 2.50.0. CVSS 8.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2023-41084: Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking

Mon, 18 Sep 2023 19:56:27 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-32612: WAVLINK TECHNOLOGY Ltd. WL-WN531AX2: Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware…

Fri, 30 Jun 2023 04:01:42 GMT

Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-35885: CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.

Tue, 20 Jun 2023 00:00:00 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. CVSS score 9.8 (7.0 or more) and EPSS 0.74 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.

ReactPHP's HTTP server parses encoded cookie names so malicious `Host-` and `Secure-` cookies can be sent

Fri, 16 Sep 2022 18:48:53 GMT

react/http >=0.7.0, <1.7.0, fixed in 1.7.0. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Centreon Does Not Set HTTPOnly Flag

Tue, 24 May 2022 16:58:02 GMT

centreon/centreon <=19.04.3, no fixed version yet. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Cookie Prefix Spoofing in CGI::Cookie.parse

Fri, 21 Jan 2022 23:22:17 GMT

cgi <0.1.0.1 || >=0.2.0, <0.2.1 || >=0.3.0, <0.3.1, fixed in 0.1.0.1, 0.2.1, 0.3.1. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Rails Multisite secure/signed cookies share secrets between sites in a multi-site application

Mon, 15 Nov 2021 17:54:01 GMT

rails_multisite <4.0.0, fixed in 4.0.0. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

Wed, 29 Sep 2021 17:12:51 GMT

getgrav/grav <1.7.21, fixed in 1.7.21. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2021-33842: Circutor SGE-PLC1000 improper authentication

Wed, 09 Jun 2021 11:39:52 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Lack of protection against cookie tossing attacks in fastify-csrf

Mon, 17 May 2021 20:53:30 GMT

fastify-csrf <3.1.0, fixed in 3.1.0. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Reliance on Cookies without validation in OctoberCMS

Wed, 05 Aug 2020 14:52:54 GMT

october/rain >=1.0.319, <1.0.468, fixed in 1.0.468. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

agentprime: CWE-565

CVE-2026-119128: ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

CVE-2026-112352: Sunhillo SureLine Authentication Bypass via Session Cookie

AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

CVE-2026-101287: Authentication bypass in Stela by Diaple Networking

CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

CVE-2026-85181: CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

CVE-2026-53871: Hermes WebUI < 0.51.368 - Profile-Scoped Authorization Bypass via Forged hermes_profile Cookie

Concrete CMS is vulnerable to IDOR in surveys

CVE-2026-0257: PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php

Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

CVE-2026-5130: Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation

CVE-2014-125112: Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution

CVE-2022-50926: WAGO 750-8212 PFC200 G2 2ETH RS Privilege Escalation

CVE-2025-65212: An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1.

CVE-2025-14440: JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie

CVE-2021-47706: COMMAX Biometric Access Control System Authentication Bypass

CVE-2025-64447: Fortinet FortiWeb: A reliance on cookies without validation and integrity checking vulnerability in Fortinet…

CVE-2025-48980: In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie attribute.

CVE-2025-59247: Azure PlayFab Elevation of Privilege Vulnerability

CVE-2025-31120: NamelessMC Vulnerable to Cookie-Based View Count Manipulation

CVE-2024-55211: An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.

CVE-2025-2395: e-Excellence U-Office Force - Improper Authentication

CVE-2024-9970: NewType FlowMaster BPM Plus - Privilege Escalation

github.com/gitpod-io/gitpod vulnerable to Cookie Tossing

CVE-2024-0947: Cookies Manipulation in Talya Informatics' Elektraweb

CVE-2021-20450: IBM Cognos Controller information disclosure

CVE-2024-21872: Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

CVE-2024-22186: Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking

CVE-2024-28288: Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability.

Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing

CVE-2024-1551: Set-Cookie response headers were being incorrectly honored in multipart HTTP responses.

CVE-2023-32725: Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.

CSRF token reuse vulnerability in github.com/gofiber/fiber/v2

Go Fiber CSRF Token Validation Vulnerability

CVE-2023-41084: Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking

CVE-2023-32612: WAVLINK TECHNOLOGY Ltd. WL-WN531AX2: Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware…

CVE-2023-35885: CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.

ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent

Centreon Does Not Set HTTPOnly Flag

Cookie Prefix Spoofing in CGI::Cookie.parse

Rails Multisite secure/signed cookies share secrets between sites in a multi-site application

Reliance on Cookies without Validation and Integrity Checking in getgrav/grav

CVE-2021-33842: Circutor SGE-PLC1000 improper authentication

Lack of protection against cookie tossing attacks in fastify-csrf

Reliance on Cookies without validation in OctoberCMS

ReactPHP's HTTP server parses encoded cookie names so malicious `Host-` and `Secure-` cookies can be sent