Catalog

Findings

Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.

SearchRecord typeSeveritySourceStackWeaknessSort

Known exploited only

Medium5.9Apache Airflow's set the JWT auth cookie without the flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g.Vuln · CVE-2026-41017 · apache · airflow · NIST NVD · Apache, nginxJun 1, 2026
Medium5.9Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.Vuln · CVE-2026-43828 · apache · shiro · CVE.org · FIRST EPSS · NIST NVD · ApacheEPSS 0.3%May 25, 2026
High7.4Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it throug…Vuln · CVE-2026-22617 · eaton · intelligent power protector · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Apr 16, 2026
Medium4.3IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies.Vuln · CVE-2026-4820 · ibm · maximo application suite · CVE.org · NIST NVD · IBMApr 1, 2026
Medium5.7In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settingsVuln · CVE-2026-32745 · jetbrains · datalore · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Mar 13, 2026
Medium5.3The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.Vuln · CVE-2026-1697 · arcinfo · pcvue · CVE.org · FIRST EPSS · NIST NVDEPSS 0.1%Feb 26, 2026