CVE-2026-126067

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

CVE-2026-126067

A flaw was found in Action Pack. Certain non-cookie session stores fail to apply the configured SameSite attribute when issuing session cookies. In web browsers that do not automatically enforce cross-site cookie restrictions, a remote attacker could induce an authenticated user's browser to send...

GHSA-GMJ8-HVJ3-49MW Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Impact Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins write the session cookie without a SameSite attribute, regardless of...

CVE-2026-126067

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

DEBIAN-CVE-2026-126067

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

CVE-2026-126067

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

CVE-2026-126067 Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

CVE-2026-126067 Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

CVE-2026-126067

The Action Pack framework is vulnerable to Cross-Site Request Forgery (CSRF) because session stores other than ActionDispatch::Session::CookieStore (such as CacheStore, MemCacheStore, and certain third-party stores) do not include a SameSite attribute on session cookies. This occurs because only ...

CVE-2026-126067: rails: Action Pack is a framework for handling and responding to web requests

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins writ...

PT-2026-144722

Name of the Vulnerable Software and Affected Versions Action Pack versions prior to 8.1.4.1 Action Pack versions prior to 8.0.5.2 Description Session stores other than ActionDispatch::Session::CookieStore including CacheStore, MemCacheStore, and third-party stores based on AbstractStore,...

CVE-2026-8640

IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery CSRF attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses dependencies which is vulnerable to multiple Critical severity CVEs.

Summary Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses dependencies which is vulnerable to multiple Critical severity CVEs. This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-11525 DESCRIPTIO...

CLEANSTART-2024-HC67605 Requests initiated through reader mode did not properly omit cookies with a SameSite attribute

CVE-2022-29912 affects multiple packages. Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. See references for individual vulnerability details...

CLEANSTART-2026-PA28672 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute

Security vulnerability affects the apache-hive package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in spring-web

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in spring-web. Spring-web is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-47883 DESCRIPTION:...

Astra Linux – vulnerability in python-tornado

In Tornado prior to version 6.5.5, cookie attribute injection could occur because the domain, path, and SAMESITE arguments passed to .RequestHandler.setcookie were not validated for malicious characters...

Sensitive Cookie with Improper SameSite Attribute

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Sensitive Cookie with Improper SameSite Attribute via improper validation of the Domain attribute in the cookie handling process. An attacker...

CLEANSTART-2026-BU33192 WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute

Security vulnerability affects the rundeck package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...

PT-2026-108529

Security vulnerability affects the apache-hive package. A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute...