CWE-1004

CVEs per yearBy the year they were published

1. 20191
2. 20202
3. 20214
4. 20223
5. 20234
6. 20245
7. 202511
8. 202618

Newest CVEs

• CVE-2026-78188

  WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes

  WebDyne

  Medium5.4
• CVE-2026-115519

  Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

  KNIME · KNIME Business Hub

  Low2.1
• CVE-2026-111063

  AIOHTTP: Secure attribute not enforced for shared cookie

  aio-libs · aiohttp

  Medium6.3
• CVE-2026-53660

  OpenAM Insecure SSO Cookie Initialization

  OpenIdentityPlatform · OpenAM

  High7.4
• CVE-2026-82697

  sambitraj Student-Management-System session_start cookie httponly flag

  sambitraj · Student-Management-System

  Medium6.3
• CVE-2026-21754

  HCL Hive is affected by multiple security vulnerabilities.

  HCL Software · Hive

  Medium5.4
• CVE-2026-57948

  Pinpoint - Insecure Session Cookie Attributes in pinpointJwt

  pinpoint-apm · pinpoint

  High7.6
• CVE-2026-11956

  TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute

  TwiN · gatus

  Medium6.3
• CVE-2026-42239

  Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover

  Budibase · budibase

  High8.1
• CVE-2026-39338

  ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration

  ChurchCRM · CRM

  High8.6

Vendors it comes up for most

1. rucio5
2. ChurchCRM2
3. IBM2
4. Moxa2
5. ABB1
6. Avaiga1
7. Azure Access Technology1
8. Budibase1
9. Business-DNA Solutions GmbH1
10. CE-PhoenixCart1