CWE-1275

CWE-1275 · 4 records · 3 with a public proof-of-concept

Records the NVD classes under CWE-1275, highest CVSS first.

  1. HIGH 7.1CVE-2026-61687public PoC2026-09-21

    Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state…

    AI risk analysis on Exploit-DB.ai →

  2. MEDIUM 5.4CVE-2026-781882026-10-31

    WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and wit…

    AI risk analysis on Exploit-DB.ai →

  3. MEDIUM 4CVE-2026-107229public PoC2026-10-07

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.16.0 until 3.0.14, ThreadSafeCookieStore incompletely validates cookie Domain attributes. Missing private-section and d…

    AI risk analysis on Exploit-DB.ai →

  4. UNSCOREDCVE-2026-107280public PoC2026-10-07

    The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public…

    AI risk analysis on Exploit-DB.ai →