CWE-1275

CVEs per yearBy the year they were published

1. 20243
2. 20256
3. 202625

Newest CVEs

• CVE-2026-78188

  WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes

  WebDyne

  Not scored
• CVE-2026-107280

  AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

  AsyncHttpClient · async-http-client

  Medium6.9
• CVE-2026-107229

  AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie tossing onto public-suffix and IP-address hosts

  AsyncHttpClient · async-http-client

  Medium4.0
• CVE-2026-61687

  hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

  hatchet-dev · hatchet

  High7.1
• CVE-2026-69215

  Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

  http4s · http4s

  Medium6.8
• CVE-2026-53660

  OpenAM Insecure SSO Cookie Initialization

  OpenIdentityPlatform · OpenAM

  High7.4
• CVE-2026-81888

  @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

  honojs · @hono/oauth-providers

  Medium5.4
• CVE-2026-47889

  Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

  Spring · Spring Framework

  High7.5
• CVE-2026-73847

  Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover

  emlog · emlog

  Medium6.8
• CVE-2026-55688

  AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

  AsyncHttpClient · async-http-client

  Medium4.0

Vendors it comes up for most

1. Concrete CMS13
2. AsyncHttpClient3
3. IBM3
4. HCL Software2
5. HCL1
6. Kimai1
7. Mozilla1
8. OTRS AG1
9. OpenIdentityPlatform1
10. Spring1