CWE-614

CVEs per yearBy the year they were published

1. 20202
2. 20213
3. 202210
4. 20236
5. 202411
6. 202516
7. 202621

Newest CVEs

• CVE-2026-78188

  WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes

  WebDyne

  Not scored
• CVE-2026-115519

  Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub

  KNIME · KNIME Business Hub

  Low2.1
• CVE-2026-56599

  HCL BigFix Service Management is affected by multiple security vulnerabilities.

  HCL Software · HCL BigFix Service Management

  Low2.2
• CVE-2026-66249

  HCL iControl is affected by a Missing Secure Attribute vulnerability

  HCL Software · iControl

  Low3.1
• CVE-2026-65655

  Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

  Temporal Technologies, Inc. · Temporal UI Server

  Low2.3
• CVE-2026-15656

  IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret

  IBM · Maximo Application Suite

  Medium4.3
• CVE-2026-48058

  nebula-mesh: Session and OIDC state cookies lack the Secure attribute

  juev · nebula-mesh

  Medium4.6
• CVE-2026-56581

  HCL MyCloud was affected with Cookie Attribute Path Not Set

  HCLSoftware · MyCloud

  Low2.6
• CVE-2024-23572

  HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should…

  HCLSoftware · Aftermarket EPC

  Medium4.2
• CVE-2026-57948

  Pinpoint - Insecure Session Cookie Attributes in pinpointJwt

  pinpoint-apm · pinpoint

  High7.6

Vendors it comes up for most

1. IBM13
2. HCL Software5
3. ikus0603
4. Apache Software Foundation2
5. HCL2
6. HCLSoftware2
7. Siemens2
8. Synology2
9. thorsten2
10. Avaiga1