CVE-2026-82697 | Low | 3.7 | 2026-08-31 | A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the f… |
CVE-2026-21754 | Medium | 5.4 | 2026-08-25 | HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakou… |
CVE-2026-57948 | Medium | 6.8 | 2026-06-29 | Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to miss… |
CVE-2026-11956 | Low | 3.7 | 2026-06-11 | A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cooki… |
CVE-2026-42239 | High | 8.1 | 2026-05-07 | Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT session token is set with httpOnly: false a… |
CVE-2026-39338 | Medium | 6.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accep… |
CVE-2026-35575 | High | 8.0 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting (Stored XSS) vulnerability in the admin panel’s group-creat… |
CVE-2026-25736 | Medium | 6.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25735 | Medium | 6.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25734 | Medium | 6.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25733 | High | 7.3 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Version… |
CVE-2026-25136 | High | 8.1 | 2026-02-25 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A refle… |
CVE-2026-0696 | Medium | 6.5 | 2026-01-16 | In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-sid… |
CVE-2026-22081 | | | 2026-01-09 | This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookie… |
CVE-2025-27223 | High | 7.5 | 2025-10-27 | TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList… |
CVE-2025-12031 | Medium | 5.3 | 2025-10-21 | HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BL… |
CVE-2025-42909 | Low | 3.0 | 2025-10-14 | SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL a… |
CVE-2025-57424 | High | 7.3 | 2025-09-29 | A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field. An attacker can insert arbitrary J… |
CVE-2025-53757 | | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router… |
CVE-2025-27453 | Medium | 5.3 | 2025-07-03 | The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript. |
CVE-2025-49189 | Medium | 5.3 | 2025-06-12 | The HttpOnlyflag of the session cookie \"@@\" is set to false. Since this flag helps preventing access to cookies via client-side scripts, setting the flag to… |
CVE-2025-47289 | Medium | 6.3 | 2025-06-02 | CE Phoenix is a free, open-source eCommerce platform. A stored cross-site scripting (XSS) vulnerability was discovered in CE Phoenix versions 1.0.9.9 through 1… |
CVE-2025-26844 | Critical | 9.8 | 2025-05-08 | An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag. |
CVE-2025-24318 | Medium | 6.8 | 2025-02-28 | Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session compromise. |
CVE-2025-0479 | | | 2025-01-20 | This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vu… |
CVE-2024-47833 | Medium | 6.5 | 2024-10-09 | Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions se… |
CVE-2022-43845 | Low | 3.7 | 2024-09-25 | IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote… |
CVE-2022-33167 | Low | 3.7 | 2024-07-30 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caus… |
CVE-2024-41685 | High | 7.5 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the router's web managemen… |
CVE-2024-6739 | Medium | 5.3 | 2024-07-15 | The session cookie in MailGates and MailAudit from Openfind does not have the HttpOnly flag enabled, allowing remote attackers to potentially steal the session… |
CVE-2023-4217 | Low | 3.1 | 2023-11-02 | A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected applicati… |
CVE-2023-4228 | Low | 3.1 | 2023-08-24 | A vulnerability has been identified in ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, where the session cookies attribute is not set pro… |
CVE-2023-2876 | Low | 3.1 | 2023-06-13 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in ABB REX640 PCL1 (firmware modules), ABB REX640 PCL2 (Firmware modules), ABB REX640 PCL3 (firmware mod… |
CVE-2022-21939 | High | 7.5 | 2023-02-09 | Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 1… |
CVE-2019-25091 | Low | 3.7 | 2022-12-27 | A vulnerability classified as problematic has been found in nsupdate.info. This affects an unknown part of the file src/nsupdate/settings/base.py of the compon… |
CVE-2022-4630 | Medium | 5.3 | 2022-12-21 | Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master. |
CVE-2022-25172 | Medium | 6.1 | 2022-05-12 | An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie miss… |
CVE-2021-42115 | High | 8.1 | 2021-11-30 | Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attac… |
CVE-2021-39210 | Medium | 6.5 | 2021-09-15 | GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remem… |
CVE-2021-3706 | High | 7.5 | 2021-09-15 | adminlte is vulnerable to Sensitive Cookie Without 'HttpOnly' Flag |
CVE-2021-34563 | Low | 3.3 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client… |
CVE-2020-27658 | High | 7.1 | 2020-10-29 | Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for rem… |
CVE-2020-6267 | Medium | 5.4 | 2020-07-14 | Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag. |
CVE-2019-8283 | Medium | 6.5 | 2019-06-07 | Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it. |