CWE-614
69 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 69Published CVEs69 of them scored
- 22Last 12 monthspublished in the last year
- 1Critical12 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-78188
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes
WebDyne
Medium5.4 - CVE-2026-115519
Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub
KNIME · KNIME Business Hub
Low2.1 - CVE-2026-56599
HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL Software · HCL BigFix Service Management
Low2.2 - CVE-2026-66249
HCL iControl is affected by a Missing Secure Attribute vulnerability
HCL Software · iControl
Low3.1 - CVE-2026-65655
Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy
Temporal Technologies, Inc. · Temporal UI Server
Low2.3 - CVE-2026-15656
IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret
IBM · Maximo Application Suite
Medium4.3 - CVE-2026-48058
nebula-mesh: Session and OIDC state cookies lack the Secure attribute
juev · nebula-mesh
Medium4.6 - CVE-2026-56581
HCL MyCloud was affected with Cookie Attribute Path Not Set
HCLSoftware · MyCloud
Low2.6 - CVE-2024-23572
HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should…
HCLSoftware · Aftermarket EPC
Medium4.2 - CVE-2026-57948
Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
pinpoint-apm · pinpoint
High7.6