CWE-1004 (CWE-1004) — 3 disclosed vulnerabilities

Records the NVD classes under CWE-1004, highest CVSS first.

UNSCOREDCVE-2026-781882026-10-31
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and wit…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-1155192026-10-22
Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attac…
AI risk analysis on Exploit-DB.ai →
UNSCOREDCVE-2026-111063public PoC2026-10-19
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. …
AI risk analysis on Exploit-DB.ai →