# CWE-614. Every Advisory and CVE whose sources give the weakness CWE-614, newest first. ## Records, newest first - [WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes](https://agentprime.io/advisories/CVE-2026-78188.md) `CVE-2026-78188` · CVE record · CVSS 5.4 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: CWE-614, CWE-1004, CWE-1275 - [Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub](https://agentprime.io/advisories/CVE-2026-115519.md) `CVE-2026-115519` · CVE record: KNIME KNIME Business Hub · CVSS 2.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-614, CWE-1004 - [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-56599.md) `CVE-2026-56599` · CVE record: HCL Software HCL BigFix Service Management · CVSS 2.2 Low · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-614 - [HCL iControl is affected by a Missing Secure Attribute vulnerability](https://agentprime.io/advisories/CVE-2026-66249.md) `CVE-2026-66249` · CVE record: HCL Software iControl · CVSS 3.1 Low · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-614 - [Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy](https://agentprime.io/advisories/CVE-2026-65655.md) `CVE-2026-65655` · CVE record: Temporal Technologies, Inc. Temporal UI Server · CVSS 2.3 Low · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-614 - [IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak…](https://agentprime.io/advisories/CVE-2026-15656.md) `CVE-2026-15656` · CVE record: IBM Maximo Application Suite · CVSS 4.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-614 - [HCL MyCloud was affected with Cookie Attribute Path Not Set](https://agentprime.io/advisories/CVE-2026-56581.md) `CVE-2026-56581` · CVE record: HCLSoftware MyCloud · CVSS 2.6 Low · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-614 - [HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token…](https://agentprime.io/advisories/CVE-2024-23572.md) `CVE-2024-23572` · CVE record: HCLSoftware Aftermarket EPC · CVSS 4.2 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-614 - [Pinpoint - Insecure Session Cookie Attributes in pinpointJwt](https://agentprime.io/advisories/CVE-2026-57948.md) `CVE-2026-57948` · CVE record: pinpoint-apm pinpoint · CVSS 7.6 High · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-614, CWE-1004 - [boruta-server sent sensitive session cookies without the Secure attribute](https://agentprime.io/advisories/CVE-2026-53661.md) `CVE-2026-53661` · CVE record: malach-it boruta-server · CVSS 8.8 High · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-614 - [TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute](https://agentprime.io/advisories/CVE-2026-11956.md) `CVE-2026-11956` · CVE record: TwiN gatus · CVSS 6.3 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-614, CWE-1004 - [nebula-mesh: Session and OIDC state cookies lack the Secure attribute](https://agentprime.io/advisories/GHSA-rqfj-vv8r-xhqc.md) `GHSA-rqfj-vv8r-xhqc`, `CVE-2026-48058`, `GO-2026-5635` · Go `github.com/juev/nebula-mesh`: affected `<0.3.2`, fixed in `0.3.2` · CVSS 4.6 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-614 - [HAX CMS Missing Secure Flag on Cookie](https://agentprime.io/advisories/CVE-2026-46398.md) `CVE-2026-46398` · CVE record: haxtheweb haxcms-php · CVSS 8.8 High · Not analysed yet · Published 5 Jun 2026 · Tags: CWE-614 - [HCL iControl was affected by Missing Cookie Attributes vulnerability.](https://agentprime.io/advisories/CVE-2025-52608.md) `CVE-2025-52608` · CVE record: HCL iControl · CVSS 3.1 Low · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-614 - [Apache Airflow's \`JWTRefreshMiddleware\` set the JWT auth cookie without the \`Secure\` flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envo...](https://agentprime.io/advisories/GHSA-95v7-h9j5-gvjr.md) `GHSA-95v7-h9j5-gvjr`, `BIT-airflow-2026-41017`, `CVE-2026-41017`, `PYSEC-2026-171` · PyPI `apache-airflow`: affected `>=3.0.0, <3.2.2`, fixed in `3.2.2` · CVSS 5.9 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-614 - [Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute](https://agentprime.io/advisories/GHSA-c6r4-qjmw-cvj2.md) `GHSA-c6r4-qjmw-cvj2`, `CVE-2026-43828` · Maven `org.apache.shiro:shiro-web`: affected `>=1.0.0-incubating, <2.2.0 || >=3.0.0-alpha-1, <3.0.0-alpha-2`, fixed in `2.2.0`, `3.0.0-alpha-2` · CVSS 5.9 Medium · Not analysed yet · Published 26 May 2026 · Tags: CWE-614 - [NocoDB: Refresh Token Cookie Set Without \`secure\` and \`sameSite\` Flags](https://agentprime.io/advisories/GHSA-f74w-272x-mqcv.md) `GHSA-f74w-272x-mqcv`, `CVE-2026-46550` · npm `nocodb`: affected `<=0.301.3`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 21 May 2026 · Tags: CWE-614 - [Eaton IPP Software: Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration…](https://agentprime.io/advisories/CVE-2026-22617.md) `CVE-2026-22617` · CVE record: Eaton IPP Software · CVSS 5.7 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-614 - [IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2\_\ was not set with secure flag](https://agentprime.io/advisories/CVE-2026-4820.md) `CVE-2026-4820` · CVE record: IBM Maximo Application Suite · CVSS 4.3 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-614 - [@grackle-ai/server has a Missing Secure Flag on Session Cookie](https://agentprime.io/advisories/GHSA-5j35-xr4g-vwf4.md) `GHSA-5j35-xr4g-vwf4` · npm `@grackle-ai/server`: affected `<0.70.5`, fixed in `0.70.5` · CVSS 4.0, no score published · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-614 - [JetBrains Datalore: In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure…](https://agentprime.io/advisories/CVE-2026-32745.md) `CVE-2026-32745` · CVE record: JetBrains Datalore · CVSS 6.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-614 - [Use of unsecure cookies for GraphicalData web service and WebClient web app](https://agentprime.io/advisories/CVE-2026-1697.md) `CVE-2026-1697` · CVE record: arcinfo PcVue · CVSS 5.3 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-614, CWE-1275 - [Kentico Xperience <= 13.0.164 Cookie Security Configuration](https://agentprime.io/advisories/CVE-2024-58317.md) `CVE-2024-58317` · CVE record: Kentico Xperience · CVSS 6.9 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-614 - [IBM Jazz for Service Management is vulnerable to "filter" cookie not sent over SSL](https://agentprime.io/advisories/CVE-2025-36249.md) `CVE-2025-36249` · CVE record: IBM Jazz for Service Management · CVSS 3.7 Low · Not analysed yet · Published 31 Oct 2025 · Tags: CWE-614 - [HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability](https://agentprime.io/advisories/CVE-2025-52614.md) `CVE-2025-52614` · CVE record: HCL Software Unica Platform · CVSS 3.5 Low · Not analysed yet · Published 12 Oct 2025 · Tags: CWE-614 - [HCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability](https://agentprime.io/advisories/CVE-2025-52632.md) `CVE-2025-52632` · CVE record: HCL AION · CVSS 6.5 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: CWE-614 - [IBM Jazz for Service Management information disclosure](https://agentprime.io/advisories/CVE-2025-36011.md) `CVE-2025-36011` · CVE record: IBM Jazz for Service Management · CVSS 4.3 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-614 - [Nameless cookies shadow secure cookies](https://agentprime.io/advisories/CVE-2025-8037.md) `CVE-2025-8037` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-614 - [Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router](https://agentprime.io/advisories/CVE-2025-53757.md) `CVE-2025-53757` · CVE record: Digisol XPON ONU Wi-Fi Router (DG-GR6821AC) · CVSS 8.7 High · Not analysed yet · Published 16 Jul 2025 · Tags: CWE-614, CWE-1004 - [CVE-2025-27450](https://agentprime.io/advisories/CVE-2025-27450.md) `CVE-2025-27450` · CVE record: Endress+Hauser Endress+Hauser MEAC300-FNADE4 · CVSS 6.5 Medium · Not analysed yet · Published 3 Jul 2025 · Tags: CWE-614 - [IBM Datacap information disclosure](https://agentprime.io/advisories/CVE-2025-36026.md) `CVE-2025-36026` · CVE record: IBM Datacap · CVSS 4.3 Medium · Not analysed yet · Published 28 Jun 2025 · Tags: CWE-614 - [Cookie without Secure attribute in phpipam/phpipam](https://agentprime.io/advisories/CVE-2024-10718.md) `CVE-2024-10718` · CVE record: phpipam phpipam/phpipam · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-614 - [Misskey CSRF vulnerability due to insecure configuration of authentication cookie attributes](https://agentprime.io/advisories/CVE-2025-24897.md) `CVE-2025-24897` · CVE record: misskey-dev misskey · CVSS 8.2 High · Not analysed yet · Published 11 Feb 2025 · Tags: Cross-site request forgery (CSRF), CWE-614, CWE-1275 - [General OpenMRS Security Advisory, January 2025: Penetration Testing Results and Patches](https://agentprime.io/advisories/GHSA-vpxm-cr3r-pjp9.md) `GHSA-vpxm-cr3r-pjp9` · Maven `org.openmrs.module:addresshierarchy` and 5 more: affected `<2.19.0`, fixed in `2.19.0` · No CVSS score · Not analysed yet · Published 30 Jan 2025 · Tags: Information disclosure, Broken access control, Open redirect, CWE-614 - [Missing Cookie Flags](https://agentprime.io/advisories/CVE-2025-24390.md) `CVE-2025-24390` · CVE record: OTRS AG OTRS · CVSS 6.8 Medium · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-614 - [IBM Security Directory Integrator information disclosure](https://agentprime.io/advisories/CVE-2024-28770.md) `CVE-2024-28770` · CVE record: IBM Security Directory Integrator and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-614 - [IBM Security Directory Integrator information disclosure](https://agentprime.io/advisories/CVE-2024-28771.md) `CVE-2024-28771` · CVE record: IBM Security Directory Integrator and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-614 - [Security Misconfiguration Vulnerability in CP Plus Router](https://agentprime.io/advisories/CVE-2025-0479.md) `CVE-2025-0479` · CVE record: CP Plus CP-XR-DE21-S Router · CVSS 8.6 High · Not analysed yet · Published 20 Jan 2025 · Tags: CWE-614, CWE-1004 - [IBM PowerHA SystemMirror for i information disclosure](https://agentprime.io/advisories/CVE-2024-55897.md) `CVE-2024-55897` · CVE record: IBM i · CVSS 4.3 Medium · Not analysed yet · Published 3 Jan 2025 · Tags: CWE-614 - [HCL BigFix Compliance is affected by a missing secure flag on a cookie](https://agentprime.io/advisories/CVE-2024-30142.md) `CVE-2024-30142` · CVE record: HCL Software BigFix Compliance · CVSS 3.8 Low · Not analysed yet · Published 7 Nov 2024 · Tags: CWE-614 - [IBM Concert information disclosure](https://agentprime.io/advisories/CVE-2024-43180.md) `CVE-2024-43180` · CVE record: IBM Concert · CVSS 4.3 Medium · Not analysed yet · Published 13 Sept 2024 · Tags: CWE-614 - [Taipy has a Session Cookie without Secure and HTTPOnly flags](https://agentprime.io/advisories/GHSA-r3jq-4r5c-j9hp.md) `GHSA-r3jq-4r5c-j9hp`, `CVE-2024-47833`, `PYSEC-2024-168` · PyPI `taipy`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 6.3 Medium · Not analysed yet · Published 27 Aug 2024 · Tags: Weak cryptography or TLS, CWE-614, CWE-1004 - [usememos/memos missing Secure cookie attribute in github.com/usememos/memos](https://agentprime.io/advisories/GHSA-qcw2-492v-57xj.md) `GHSA-qcw2-492v-57xj`, `CVE-2022-4683`, `GO-2022-1192` · Go `github.com/usememos/memos`: affected `<0.9.0`, fixed in `0.9.0` · CVSS 4.3 Medium · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-614 - [Insecure cookies in Openshift Origin in github.com/openshift/origin](https://agentprime.io/advisories/GHSA-rqph-25q9-9jhp.md) `GHSA-rqph-25q9-9jhp`, `CVE-2015-3207`, `GO-2022-0505` · Go `github.com/openshift/origin`: affected `<1.0.0`, fixed in `1.0.0` · No CVSS score · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-614 - [Cookie Without Secure Flag Set Vulnerability](https://agentprime.io/advisories/CVE-2024-41684.md) `CVE-2024-41684` · CVE record: SyroTech SyroTech SY-GPON-1110-WDONT router · CVSS 6.9 Medium · Not analysed yet · Published 26 Jul 2024 · Tags: CWE-614 - [IBM Datacap Navigator information disclosure](https://agentprime.io/advisories/CVE-2024-39734.md) `CVE-2024-39734` · CVE record: IBM Datacap Navigator · CVSS 4.3 Medium · Not analysed yet · Published 14 Jul 2024 · Tags: CWE-614 - [IBM Security ReaQta information disclosure](https://agentprime.io/advisories/CVE-2023-33860.md) `CVE-2023-33860` · CVE record: IBM Security QRadar EDR · CVSS 5.3 Medium · Not analysed yet · Published 10 Jul 2024 · Tags: CWE-614 - [Siemens SINEC Traffic Analyzer: A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All…](https://agentprime.io/advisories/CVE-2024-35211.md) `CVE-2024-35211` · CVE record: Siemens SINEC Traffic Analyzer · CVSS 6.8 Medium · Not analysed yet · Published 11 Jun 2024 · Tags: CWE-614 - [Session Hijacking Vulnerability in Hitachi Ops Center Analyzer](https://agentprime.io/advisories/CVE-2024-2493.md) `CVE-2024-2493` · CVE record: Hitachi Hitachi Ops Center Analyzer · CVSS 7.5 High · Not analysed yet · Published 23 Apr 2024 · Tags: CWE-614 - [IBM Secure Proxy information disclosure](https://agentprime.io/advisories/CVE-2023-46179.md) `CVE-2023-46179` · CVE record: IBM Secure Proxy · CVSS 4.3 Medium · Not analysed yet · Published 15 Mar 2024 · Tags: CWE-614 - [IBM Sterling B2B Integrator information disclosure](https://agentprime.io/advisories/CVE-2023-42016.md) `CVE-2023-42016` · CVE record: IBM Sterling B2B Integrator · CVSS 4.3 Medium · Not analysed yet · Published 9 Feb 2024 · Tags: CWE-614 - [SourceCodester Engineers Online Portal missing secure attribute](https://agentprime.io/advisories/CVE-2024-0349.md) `CVE-2024-0349` · CVE record: SourceCodester Engineers Online Portal · CVSS 3.7 Low · Not analysed yet · Published 9 Jan 2024 · Tags: CWE-614 - [Cookie Without Secure Flag](https://agentprime.io/advisories/CVE-2023-5035.md) `CVE-2023-5035` · CVE record: Moxa PT-G503 Series · CVSS 3.1 Low · Not analysed yet · Published 2 Nov 2023 · Tags: CWE-614 - [Sensitive cookie in HTTPS session without 'Secure' attribute in thorsten/phpmyfaq](https://agentprime.io/advisories/GHSA-34w4-wrqp-j47g.md) `GHSA-34w4-wrqp-j47g`, `CVE-2023-5866`, `PKSA-234x-mfj9-vyxm` · Packagist `thorsten/phpmyfaq`: affected `<3.2.1`, fixed in `3.2.1` · CVSS 6.3 Medium · Not analysed yet · Published 31 Oct 2023 · Tags: CWE-614 - [Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2](https://agentprime.io/advisories/CVE-2023-4654.md) `CVE-2023-4654` · CVE record: instantsoft instantsoft/icms2 · CVSS 2.6 Low · Not analysed yet · Published 31 Aug 2023 · Tags: CWE-614 - [Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in it-novum/openitcockpit](https://agentprime.io/advisories/CVE-2023-3520.md) `CVE-2023-3520` · CVE record: it-novum it-novum/openitcockpit · CVSS 4.3 Medium · Not analysed yet · Published 6 Jul 2023 · Tags: CWE-614 - [Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)](https://agentprime.io/advisories/CVE-2022-21940.md) `CVE-2022-21940` · CVE record: Johnson Controls System Configuration Tool (SCT) · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2023 · Tags: CWE-614 - [Pyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute](https://agentprime.io/advisories/GHSA-m3g7-wrrq-v5c8.md) `GHSA-m3g7-wrrq-v5c8`, `CVE-2023-0055`, `PYSEC-2026-905` · PyPI `pyload-ng`: affected `<0.5.0b3.dev32`, fixed in `0.5.0b3.dev32` · CVSS 3.1 Low · Not analysed yet · Published 5 Jan 2023 · Tags: Weak cryptography or TLS, CWE-614 - [Insecure generation of cookies in github.com/go-macaron/csrf](https://agentprime.io/advisories/GHSA-hhxg-px5h-jc32.md) `GHSA-hhxg-px5h-jc32`, `CVE-2018-25060`, `GO-2022-1213` · Go `github.com/go-macaron/csrf`: affected `<0.0.0-20180426211050-dadd1711a617`, fixed in `0.0.0-20180426211050-dadd1711a617` · CVSS 3.7 Low · Not analysed yet · Published 3 Jan 2023 · Tags: CWE-614 - [phpMyFAQ has insecure HTTP cookies](https://agentprime.io/advisories/GHSA-wpgc-5cr5-h9gg.md) `GHSA-wpgc-5cr5-h9gg`, `CVE-2022-4409`, `PKSA-9tvb-nh5n-s91m` · Packagist `thorsten/phpmyfaq`: affected `<3.1.9`, fixed in `3.1.9` · CVSS 6.3 Medium · Not analysed yet · Published 11 Dec 2022 · Tags: Weak cryptography or TLS, CWE-614 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .