Lucene search
+L

32400 matches found

Cvelist
Cvelist
added 2026/09/15 7:04 p.m.26 views

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

6.8CVSS0.00259EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/15 7:04 p.m.6 views

EUVD-2026-79179

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

6.8CVSS5.7AI score0.00259EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/15 7:04 p.m.6 views

CVE-2026-69214 Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

6.8CVSS5.7AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/15 6:56 p.m.26 views

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

4.8CVSS0.00216EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/15 6:56 p.m.10 views

CVE-2026-69211

Http4s is a Scala library for HTTP services. Prior to 0.23.35 and 1.0.0-M47 , the ResponseCookie.render method writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from u...

4.8CVSS5.7AI score0.00216EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/15 6:56 p.m.10 views

CVE-2026-69211 Http4s: Set-Cookie rendering does not escape attribute delimiters

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, and extension values without neutralizing semicolons or control characters. An application that constructs a ResponseCookie from unvalidated...

4.8CVSS5.7AI score
SaveExploits0References6
Kitploit
Kitploit
added 2026/09/15 6:11 p.m.8 views

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where multiple cookie header fields can be merged without being properly counted...

7.5CVSS7.4AI score0.34303EPSS
SaveExploits10
Kitploit
Kitploit
added 2026/09/15 5:31 p.m.8 views

CVE-2023-26136

Research on the vulnerability CVE-2023-26136 Description Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which objects are...

9.8CVSS6.5AI score0.02542EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/15 5:11 p.m.9 views

CVE-2026-5513

CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2 存储型XSS via Cookie CVE-2026-5513 — Bookly ≤ 27.2 存储型XSS via Cookie CVE CVSS 类型 认证 https://t.me/FreeToolsCpa CVE 文件在群组 概述 字段 值 CVE ID CVE-2026-5513 漏洞类型 存储型跨站脚本(XSS) 插件 Bookly — 在线预约和预约管理系统 受影响版本 ≤ 27.2 修复版本 27.3+ CVSS 3.1 7.2(高危...

7.2CVSS5.9AI score0.00437EPSS
SaveExploits1
RedhatCVE
RedhatCVE
added 2026/09/15 4:33 p.m.6 views

CVE-2026-91991

A flaw was found in Tornado. An attacker can bypass security validation in the setcookie function by using capitalized or legacy keyword arguments. This allows the attacker to inject arbitrary cookie attributes, such as Domain or SameSite, and modify cookie security settings. The consequence is t...

6.3CVSS5.8AI score0.00219EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/15 4:30 p.m.41 views

CVE-2026-55149

Vouch Proxy is an SSO and OAuth/OIDC login gateway for Nginx. In versions prior to 0.48.0 (specifically v0.47.2), the Cookie() function in pkg/cookie/cookie.go parses the multipart cookie part count from an attacker-controlled cookie name and passes it unbounded to make([]string, N). A single una...

7.5CVSS5.8AI score0.00399EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/15 4:30 p.m.8 views

CVE-2026-55149 Vouch Proxy: Unbounded Multipart Cookie Allocation DoS

Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the authrequest module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to makestring, numParts without checking that the value is...

7.5CVSS5.8AI score
SaveExploits0References5
NVD
NVD
added 2026/09/15 4:17 p.m.6 views

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

6.3CVSS0.00219EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/15 4:17 p.m.9 views

DEBIAN-CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

5.4CVSS5.8AI score0.00219EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/15 3:18 p.m.13 views

CVE-2026-91991

Tornado (Python web framework) versions before 6.5.8 contain an incomplete fix for cookie attribute injection in the set_cookie function. An attacker can pass capitalized or legacy keyword arguments (e.g., Domain, Path, SameSite) to embed semicolon-delimited data, bypassing validation and modifyi...

6.3CVSS5.8AI score0.00219EPSS
SaveExploits0References2
Debian CVE
Debian CVE
added 2026/09/15 3:18 p.m.9 views

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

6.3CVSS5.8AI score0.00219EPSS
SaveExploits0
EUVD
EUVD
added 2026/09/15 3:18 p.m.8 views

EUVD-2026-78663

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

6.3CVSS5.8AI score0.00219EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/15 3:18 p.m.5 views

CVE-2026-91991 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

6.3CVSS5.8AI score
SaveExploits0References4
NVD
NVD
added 2026/09/15 3:17 p.m.5 views

CVE-2026-55617

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...

6.9CVSS0.00272EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/15 3:00 p.m.9 views

CVE-2026-0257

CVE-2026-0257 Vulnerabilidad de omisión de autenticación en PAN-OS GlobalProtect ⚡ Uso simple Utilice este proyecto solo en entornos seguros y autorizados, como: Máquinas virtuales locales Contenedores Docker Configuraciones de laboratorio aisladas Entornos de pruebas de penetración autorizados...

9.1CVSS6.8AI score0.95156EPSS
SaveExploits11References1
Rows per page
Query Builder