CWE-1004
48 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 48Published CVEs48 of them scored
- 18Last 12 monthspublished in the last year
- 1Critical17 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-78188
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes
WebDyne
Medium5.4 - CVE-2026-115519
Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub
KNIME · KNIME Business Hub
Low2.1 - CVE-2026-111063
AIOHTTP: Secure attribute not enforced for shared cookie
aio-libs · aiohttp
Medium6.3 - CVE-2026-53660
OpenAM Insecure SSO Cookie Initialization
OpenIdentityPlatform · OpenAM
High7.4 - CVE-2026-82697
sambitraj Student-Management-System session_start cookie httponly flag
sambitraj · Student-Management-System
Medium6.3 - CVE-2026-21754
HCL Hive is affected by multiple security vulnerabilities.
HCL Software · Hive
Medium5.4 - CVE-2026-57948
Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
pinpoint-apm · pinpoint
High7.6 - CVE-2026-11956
TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute
TwiN · gatus
Medium6.3 - CVE-2026-42239
Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
Budibase · budibase
High8.1 - CVE-2026-39338
ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration
ChurchCRM · CRM
High8.6