CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
41 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-22081 — Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers
- CVE-2025-53757 — Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router
- CVE-2025-0479 — Security Misconfiguration Vulnerability in CP Plus Router
- CVE-2026-25136 — Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
- CVE-2026-39338 — ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration
- CVE-2024-41685 — Cookie Without HTTPOnly Flag Set Vulnerability
- CVE-2025-24318 — Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flag
- CVE-2026-42239 — Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
- CVE-2026-35575 — ChurchCRM has Stored XSS in Group Name
- CVE-2026-0696 — Session Cookies Missing HttpOnly Attribute
- CVE-2026-57948 — Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
- CVE-2025-47289 — Stored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly Flag
- CVE-2024-47833 — Session Cookie without Secure and HTTPOnly flags in taipy
- CVE-2026-25736 — Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute
- CVE-2025-49189 — Cookie missing HttpOnly flag
- CVE-2025-27453 — CVE-2025-27453
- CVE-2025-12031 — HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute
- CVE-2026-82697 — sambitraj Student-Management-System session_start cookie httponly flag
- CVE-2026-11956 — TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute
- CVE-2026-21754 — HCL Hive is affected by multiple security vulnerabilities.
Recently published
- CVE-2026-82697 — sambitraj Student-Management-System session_start cookie httponly flag
- CVE-2026-21754 — HCL Hive is affected by multiple security vulnerabilities.
- CVE-2026-57948 — Pinpoint - Insecure Session Cookie Attributes in pinpointJwt
- CVE-2026-11956 — TwiN gatus OIDC Session Cookie oidc.go setSessionCookie missing secure attribute
- CVE-2026-42239 — Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
- CVE-2026-39338 — ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration
- CVE-2026-35575 — ChurchCRM has Stored XSS in Group Name
- CVE-2026-25736 — Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute
- CVE-2026-25136 — Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
- CVE-2026-0696 — Session Cookies Missing HttpOnly Attribute
- CVE-2026-22081 — Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers
- CVE-2025-12031 — HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute
- CVE-2025-42909 — Security Misconfiguration vulnerability in SAP Cloud Appliance Library Appliances
- CVE-2025-53757 — Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC Router
- CVE-2025-27453 — CVE-2025-27453
- CVE-2025-49189 — Cookie missing HttpOnly flag
- CVE-2025-47289 — Stored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly Flag
- CVE-2025-24318 — Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flag
- CVE-2025-0479 — Security Misconfiguration Vulnerability in CP Plus Router
- CVE-2024-47833 — Session Cookie without Secure and HTTPOnly flags in taipy