CWE-1275
34 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 34Published CVEs34 of them scored
- 27Last 12 monthspublished in the last year
- 1Critical5 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-78188
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes
WebDyne
Medium5.4 - CVE-2026-107280
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk
AsyncHttpClient · async-http-client
Medium6.9 - CVE-2026-107229
AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts
AsyncHttpClient · async-http-client
Medium4.0 - CVE-2026-61687
hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
hatchet-dev · hatchet
High7.1 - CVE-2026-69215
Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin
http4s · http4s
Medium6.8 - CVE-2026-53660
OpenAM Insecure SSO Cookie Initialization
OpenIdentityPlatform · OpenAM
High7.4 - CVE-2026-81888
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
honojs · @hono/oauth-providers
Medium5.4 - CVE-2026-47889
Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
Spring · Spring Framework
High7.5 - CVE-2026-73847
Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover
emlog · emlog
Medium6.8 - CVE-2026-55688
AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore
AsyncHttpClient · async-http-client
Medium4.0