CVE-2026-65655 | | | 2026-08-11 | When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected… |
CVE-2026-15656 | Medium | 4.3 | 2026-08-05 | IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the c… |
CVE-2026-48058 | | | 2026-07-28 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/web/session.go and internal/web/oidc… |
CVE-2026-56581 | Low | 2.6 | 2026-07-21 | HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens. |
CVE-2024-23572 | Medium | 4.2 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should re… |
CVE-2026-57948 | Medium | 6.8 | 2026-06-29 | Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows attackers to access the pinpointJwt session cookie due to miss… |
CVE-2026-46550 | Medium | 5.4 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the refresh-token cookie was set with httpOnly: true but missing both the secure… |
CVE-2026-53661 | | | 2026-06-11 | Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0… |
CVE-2026-11956 | Low | 3.7 | 2026-06-11 | A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of the file security/oidc.go of the component OIDC Session Cooki… |
CVE-2026-46398 | | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.0.0, the haxcms_refresh_token cookie is… |
CVE-2025-52608 | Low | 3.1 | 2026-06-04 | HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, incl… |
CVE-2026-41017 | Medium | 5.9 | 2026-06-01 | Apache Airflow's `JWTRefreshMiddleware` set the JWT auth cookie without the `Secure` flag, so deployments running the Airflow API server behind an HTTPS-termin… |
CVE-2026-43828 | Medium | 6.5 | 2026-05-25 | Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.
This issue affects Apache Shiro from 1.0 to 2.1.0… |
CVE-2026-22617 | Medium | 5.7 | 2026-04-16 | Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit i… |
CVE-2026-4820 | Medium | 4.3 | 2026-04-01 | IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to ge… |
CVE-2026-32745 | Medium | 6.3 | 2026-03-13 | In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings |
CVE-2026-1697 | Medium | 6.5 | 2026-02-26 | The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included. |
CVE-2024-58317 | Medium | 5.3 | 2025-12-18 | A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.conf… |
CVE-2025-36249 | Low | 3.7 | 2025-10-31 | IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to… |
CVE-2025-52614 | Low | 3.5 | 2025-10-12 | HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suita… |
CVE-2025-52632 | Medium | 6.5 | 2025-10-10 | A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0. |
CVE-2025-36011 | Medium | 4.3 | 2025-09-09 | IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to… |
CVE-2025-8037 | Critical | 9.1 | 2025-07-22 | Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie includ… |
CVE-2025-53757 | | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on session cookies associated with the router… |
CVE-2025-27450 | Medium | 6.5 | 2025-07-03 | The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to establish an unencrypted HTTP connection to… |
CVE-2025-36026 | Medium | 4.3 | 2025-06-28 | IBM Datacap 9.1.7, 9.1.8, and 9.1.9
does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie val… |
CVE-2024-10718 | High | 7.5 | 2025-03-20 | In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookie… |
CVE-2025-24897 | High | 8.2 | 2025-02-11 | Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, due to a lack of CSRF protectio… |
CVE-2025-24390 | Medium | 6.8 | 2025-01-27 | A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS… |
CVE-2024-28771 | Medium | 4.8 | 2025-01-27 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or sessio… |
CVE-2024-28770 | Medium | 4.8 | 2025-01-27 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or sessio… |
CVE-2025-0479 | | | 2025-01-20 | This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vu… |
CVE-2024-55897 | Medium | 4.3 | 2025-01-03 | IBM PowerHA SystemMirror for i 7.4 and 7.5
does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the coo… |
CVE-2024-30142 | Low | 3.8 | 2024-11-07 | HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting… |
CVE-2024-47833 | Medium | 6.5 | 2024-10-09 | Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions se… |
CVE-2024-43180 | Medium | 4.3 | 2024-09-13 | IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http… |
CVE-2024-41684 | Medium | 5.3 | 2024-07-26 | This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the router's web management… |
CVE-2024-39734 | Medium | 4.3 | 2024-07-14 | IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able… |
CVE-2023-33860 | Medium | 5.3 | 2024-07-10 | IBM Security QRadar EDR 3.12 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by se… |
CVE-2024-35211 | Medium | 5.5 | 2024-06-11 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V1.2). The affected web server, after a successful login, se… |
CVE-2024-2493 | High | 7.5 | 2024-04-23 | Session Hijacking vulnerability in Hitachi Ops Center Analyzer.This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.1-00.
|
CVE-2023-46179 | Medium | 4.3 | 2024-03-15 | IBM Sterling Secure Proxy 6.0.3 and 6.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie… |
CVE-2023-42016 | Medium | 4.3 | 2024-02-09 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.3 does not set the secure attribute on authorization tokens or s… |
CVE-2024-0349 | Low | 3.7 | 2024-01-09 | A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown func… |
CVE-2023-5035 | Low | 3.1 | 2023-11-02 | A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is no… |
CVE-2023-5866 | Medium | 5.7 | 2023-10-31 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
CVE-2023-4654 | Low | 3.5 | 2023-08-31 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1. |
CVE-2023-3520 | Medium | 4.6 | 2023-07-06 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6. |
CVE-2022-21940 | High | 7.5 | 2023-02-09 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and v… |
CVE-2023-0055 | Medium | 5.3 | 2023-01-04 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. |
CVE-2018-25060 | Low | 3.7 | 2022-12-30 | A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipula… |
CVE-2022-4683 | Medium | 6.5 | 2022-12-23 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4409 | High | 7.5 | 2022-12-11 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-3251 | Medium | 5.3 | 2022-09-21 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2. |
CVE-2022-3250 | Medium | 5.3 | 2022-09-21 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6. |
CVE-2022-3174 | High | 7.5 | 2022-09-13 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2. |
CVE-2015-3207 | Medium | 5.3 | 2022-07-07 | In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes. |
CVE-2022-25151 | High | 7.5 | 2022-06-09 | Within the Service Desk module of the ITarian platform (SAAS and on-premise), a remote attacker can obtain sensitive information, caused by the failure to set… |
CVE-2022-24045 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2021-27764 | High | 7.4 | 2022-05-06 | Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) |
CVE-2021-35236 | Low | 3.1 | 2021-10-27 | The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie… |
CVE-2021-3882 | Medium | 6.8 | 2021-10-14 | LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy… |
CVE-2020-29024 | Medium | 5.3 | 2021-02-16 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in (GTA) GoToAppliance of Secomea GateManager could allow an attacker to gain access… |
CVE-2020-27651 | Medium | 5.8 | 2020-10-29 | Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attac… |
CVE-2020-27650 | Medium | 5.8 | 2020-10-29 | Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remo… |