Skip to content
CVE Tracker

CWE-384

458 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 458 in the listAtom feed of new CVEsWhat CWE-384 is, at MITRE (opens in a new tab)
Published CVEs
458
Last 12 months
99
Critical
75
Known exploited
1

Critical 75High 163Medium 192Low 27Not scored 1

CVEs per yearBy the year they were published

  1. 20194
  2. 20192
  3. 20203
  4. 202223
  5. 202338
  6. 20234
  7. 202538
  8. 202550
  9. 202674
  10. 202649
  11. 202638
  12. 20261

Known exploitedNewest addition to KEV first

  • CVE-2026-102489

    Undisclosed RCE in Zammad v6.3 and higher

    Zammad GmbH · Zammad

    ExploitedHigh8.7

Newest CVEs

  • CVE-2026-121501

    mathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation

    mathurvishal · CloudClassroom-PHP-Project

    Medium5.3
  • CVE-2026-82840

    Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication

    Apache Software Foundation · Apache Wicket

    High7.2
  • CVE-2026-115910

    Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim

    python-social-auth · social-core

    Medium6.8
  • CVE-2026-49410

    OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation

    tinyhumansai · openhuman

    High8.1
  • CVE-2026-55682

    WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php

    LabRedesCefetRJ · WeGIA

    High8.1
  • CVE-2026-107421

    WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability

    VideoWhisper.com · Broadcast Live Video

    High7.3
  • CVE-2026-93909

    IBM WebSphere Application Server Liberty is affected by an authentication bypass

    IBM · WebSphere Application Server - Liberty

    Critical9.1
  • CVE-2026-63161

    Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

    Omnispace · Agora Project

    High8.6
  • CVE-2024-34324

    An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the…

    Product not named

    Critical9.1
  • CVE-2026-107226

    AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

    AsyncHttpClient · async-http-client

    Medium6.8

Vendors it comes up for most

  1. IBM38
  2. Apache Software Foundation17
  3. Jenkins Project8
  4. Red Hat7
  5. HCL Software6
  6. Dell5
  7. Hewlett Packard Enterprise (HPE)4
  8. IBM Corporation4
  9. Mitsubishi Electric Corporation4
  10. SAP SE4