CWE-565

CVEs per yearBy the year they were published

1. 20081
2. 20111
3. 20173
4. 20183
5. 20196
6. 20207
7. 20215
8. 202212
9. 20239
10. 202411
11. 20258
12. 202620

Known exploitedNewest addition to KEV first

• CVE-2026-0257

  PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

  Palo Alto Networks · Cloud NGFW

  ExploitedHigh7.8

Newest CVEs

• CVE-2026-123319

  In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection

  JetBrains · Ktor

  Low3.7
• CVE-2026-119128

  ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie

  zitadel · zitadel

  Critical9.1
• CVE-2026-118661

  Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies

  capricorn86 · happy-dom

  Medium6.5
• CVE-2026-112352

  Sunhillo SureLine Authentication Bypass via Session Cookie

  Sunhillo Corporation · SureLine

  Critical9.1
• CVE-2026-111749

  AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies

  aio-libs · aiohttp

  Low2.3
• CVE-2026-101287

  Authentication bypass in Stela by Diaple Networking

  Diaple · Stela

  Critical9.3
• CVE-2026-76186

  Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

  Apache Software Foundation · Apache Airflow Keycloak provider

  Critical9.1
• CVE-2026-69215

  Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

  http4s · http4s

  Medium6.8
• CVE-2026-69214

  Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

  http4s · http4s

  Medium6.8
• CVE-2026-85181

  CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum

  dianping · cat

  Critical9.3

Vendors it comes up for most

1. IBM8
2. Electrolink2
3. Mozilla2
4. gofiber2
5. http4s2
6. Apache Software Foundation1
7. Brave1
8. COMMAX Co., Ltd.1
9. Cellinx1
10. Circutor1