10636 matches found
UBUNTU-CVE-2026-88038
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-88038
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
EUVD-2026-75398
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
2pg-oauth (>=1.0.0, <=1.0.1), 3dshex (>=0.1.0, <=0.5.3) +14699 more potentially affected by CVE-2026-88038 via cookies (>=0.1.2, <=0.9.1)
cookies NPM version =0.1.2, =1.0.0, =0.1.0, =0.2.0, =4.11.0, =0.1.4, =1.0.4, =1.0.3, =1.0.0, =1.0.2, =1.0.3, =1.0.3, =1.0.0, =1.0.2, =1.0.5 and more Source cves: CVE-2026-88038 Source advisory: MEND:CVE-2026-88038...
CVE-2026-88038 cookies vulnerable to Set-Cookie attribute injection via unvalidated domain and path options
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-88038
The cookies Node.js library (used by Koa via ctx.cookies) is vulnerable to Set-Cookie attribute injection (CWE-74) in versions before 0.9.2 . The domain and path options are validated against a permissive RFC 7230 field-content matcher that allows semicolons, while the cookie name and value are c...
CVE-2026-88038
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
SUSE CVE-2026-80890
In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctpunpackcookie skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing...
PT-2026-89366
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-88038: Improper Neutralization of Special Elements in Output Used by a Downstream Component
cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissiv...
CVE-2026-87015
Open WebUI versions 0.6.27 through 0.11.1 are affected by a session cookie leakage flaw in backend/open_webui/utils/tools.py . The cookie jar from the enclosing connection loop was not bound to each external tool callable, so when multiple tool servers were attached and a session or system OAuth ...
firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...
firefox: thunderbird: Privilege escalation in the Networking: Cookies component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Networking: Cookies component...
firefox: Site isolation issue in the Networking: Cookies component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking: Cookies component...
firefox: Site isolation issue in the Networking: Cookies component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking: Cookies component...
firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...
firefox: Site isolation issue in the Networking: Cookies component
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking: Cookies component...
firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...