CVE-2026-85181 | Critical | 9.8 | 2026-09-03 | CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline… |
CVE-2026-75757 | | | 2026-08-31 | Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind a… |
CVE-2026-53871 | High | 8.1 | 2026-06-17 | Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names fro… |
CVE-2026-8337 | Medium | 5.3 | 2026-05-21 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys. To be vulnerable, a site would have to be configured in such a way that both public and private… |
CVE-2026-0257 | Critical | 9.1 | 2026-05-13 | Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security res… |
CVE-2026-39963 | Medium | 6.9 | 2026-04-15 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_S… |
CVE-2026-39324 | Critical | 9.8 | 2026-04-07 | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when c… |
CVE-2026-5130 | High | 8.8 | 2026-03-30 | The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege Escalation in versions up to and including 1.3.2. This was due t… |
CVE-2014-125112 | Critical | 9.8 | 2026-03-26 | Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution.
Plack::Middleware::Session::Cookie versions through 0.21 has a… |
CVE-2022-50926 | Critical | 9.8 | 2026-01-13 | WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can… |
CVE-2025-65212 | Critical | 9.8 | 2026-01-06 | An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification… |
CVE-2025-14440 | Critical | 9.8 | 2025-12-13 | The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authent… |
CVE-2021-47706 | | | 2025-12-09 | COMMAX Biometric Access Control System 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access sensitive informat… |
CVE-2025-64447 | High | 8.1 | 2025-12-09 | A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb… |
CVE-2025-48980 | Medium | 6.5 | 2025-10-31 | In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect th… |
CVE-2025-59247 | High | 8.8 | 2025-10-09 | Azure PlayFab Elevation of Privilege Vulnerability |
CVE-2025-31120 | Medium | 5.3 | 2025-04-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum… |
CVE-2024-55211 | High | 8.4 | 2025-04-17 | An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie. |
CVE-2025-2395 | Critical | 9.8 | 2025-03-17 | The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter… |
CVE-2024-9970 | High | 8.8 | 2024-10-15 | The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to… |
CVE-2024-9820 | Medium | 6.5 | 2024-10-15 | The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-f… |
CVE-2024-21583 | Medium | 4.1 | 2024-07-19 | Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/com… |
CVE-2024-39734 | Medium | 4.3 | 2024-07-14 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able… |
CVE-2024-0947 | Critical | 9.8 | 2024-06-27 | Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Man… |
CVE-2021-20450 | Medium | 4.3 | 2024-05-03 | IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the… |
CVE-2024-22186 | High | 8.8 | 2024-04-18 | The application suffers from a privilege escalation vulnerability. An
attacker logged in as guest can escalate his privileges by poisoning the
cookie to beco… |
CVE-2024-21872 | High | 7.5 | 2024-04-18 | The device allows an unauthenticated attacker to bypass authentication
and modify the cookie to reveal hidden pages that allows more critical
operations to t… |
CVE-2024-28288 | Critical | 9.8 | 2024-03-30 | Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An atta… |
CVE-2024-28233 | High | 8.1 | 2024-03-27 | JupyterHub is an open source multi-user server for Jupyter notebooks. By tricking a user into visiting a malicious subdomain, the attacker can achieve an XSS d… |
CVE-2024-1551 | Medium | 6.1 | 2024-02-20 | Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well… |
CVE-2023-32725 | Critical | 9.6 | 2023-12-18 | The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be use… |
CVE-2023-45141 | High | 8.6 | 2023-10-16 | Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allow… |
CVE-2023-45128 | Critical | 10.0 | 2023-10-16 | Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allow… |
CVE-2023-41084 | Critical | 10.0 | 2023-09-18 |
Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the… |
CVE-2023-3747 | Medium | 5.5 | 2023-09-07 | Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by the Administrators… |
CVE-2023-32612 | High | 7.2 | 2023-06-30 | Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrat… |
CVE-2023-35885 | Critical | 9.8 | 2023-06-20 | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. |
CVE-2023-3050 | Critical | 9.8 | 2023-06-13 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypas… |
CVE-2022-3083 | Low | 3.9 | 2023-02-01 | All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigati… |
CVE-2022-38297 | Critical | 9.8 | 2022-09-12 | UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning. |
CVE-2022-36032 | Medium | 5.3 | 2022-09-06 | ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to… |
CVE-2022-2615 | Medium | 6.5 | 2022-08-12 | Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-35284 | High | 7.5 | 2022-07-25 | IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X… |
CVE-2022-30620 | High | 8.2 | 2022-07-18 | On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie… |
CVE-2016-15002 | High | 7.3 | 2022-06-09 | A vulnerability, which was classified as critical, was found in MONyog Ultimate 6.63. This affects an unknown part of the component Cookie Handler. The manipul… |
CVE-2022-29248 | High | 8.0 | 2022-05-25 | Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not… |
CVE-2022-22785 | Medium | 5.9 | 2022-05-18 | The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom do… |
CVE-2022-28113 | High | 7.2 | 2022-04-15 | An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session… |
CVE-2022-1148 | Medium | 5.3 | 2022-04-04 | Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14… |
CVE-2021-36338 | Medium | 6.3 | 2022-01-21 | Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious user could potentially exploit this vulne… |
CVE-2021-41819 | High | 7.5 | 2022-01-01 | CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby. |
CVE-2021-41263 | High | 8.3 | 2021-11-15 | rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite… |
CVE-2021-3818 | Medium | 5.3 | 2021-09-27 | grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking |
CVE-2021-33842 | High | 8.8 | 2021-06-09 | Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an au… |
CVE-2021-29624 | Medium | 6.5 | 2021-05-19 | fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "doubl… |
CVE-2021-28171 | Critical | 9.8 | 2021-04-06 | The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data… |
CVE-2020-29668 | Low | 3.7 | 2020-12-10 | Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie… |
CVE-2020-26955 | Medium | 6.5 | 2020-12-09 | When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same do… |
CVE-2020-4749 | Medium | 4.3 | 2020-10-20 | IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie… |
CVE-2020-7070 | Medium | 4.3 | 2020-10-02 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-dec… |
CVE-2019-4688 | Medium | 4.3 | 2020-08-26 | IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get… |
CVE-2020-15128 | Medium | 6.1 | 2020-07-31 | In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of… |
CVE-2019-4638 | Low | 3.7 | 2020-01-28 | IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive… |
CVE-2012-5631 | High | 8.8 | 2019-11-25 | ipa 3.0 does not properly check server identity before sending credential containing cookies |
CVE-2019-4330 | Medium | 4.3 | 2019-10-29 | IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to s… |
CVE-2019-17104 | High | 7.5 | 2019-10-08 | In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set. |
CVE-2019-4305 | Medium | 5.3 | 2019-09-30 | IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force… |
CVE-2019-7266 | Critical | 9.8 | 2019-07-02 | Linear eMerge 50P/5000P devices allow Authentication Bypass. |
CVE-2018-20512 | Critical | 9.8 | 2019-01-03 | EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies. |
CVE-2018-19224 | High | 7.5 | 2018-11-12 | An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies. |
CVE-2018-5190 | Critical | 9.8 | 2018-04-17 | PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pc_… |
CVE-2018-5455 | Critical | 9.8 | 2018-03-05 | A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The… |
CVE-2017-8034 | Medium | 6.6 | 2017-07-17 | The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions… |
CVE-2017-7279 | Critical | 9.8 | 2017-04-12 | An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login. |
CVE-2017-6896 | High | 8.8 | 2017-03-14 | Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just… |
CVE-2011-3887 | | | 2011-10-25 | Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cook… |
CVE-2008-5784 | Critical | 9.8 | 2008-12-31 | V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1. |