Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabExplore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Recent security developmentsWebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
Exploitation not established
Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
Apache Airflow's JWTRefreshMiddleware set the JWT auth cookie without the Secure flag, so deployments running the Airflow API server behind an HTTPS-terminating reverse proxy (e.g. nginx / Envoy / a managed load balancer that terminates TLS and forwards plaintext to the API server, the default cloud-native topology) would have the user's session JWT replayed over any cleartext HTTP request to the same host. A network-positioned attacker (Wi-Fi MITM, hostile LAN, captive-portal proxy) could induce a logged-in user's browser to issue an HTTP request to the deployment's hostname and capture the JWT cookie out of that request, then replay it against the authenticated API. Affects deployments where the Airflow API server is reached through a TLS-terminating proxy and the cookie's secure-by-default protection is load-bearing for session integrity. Users are advised to upgrade to apache-airflow 3.2.2 or later.
No structured fix or guidance is available here. Check the latest publisher advisory.
Exploitation not established
