Sensitive Cookie Without 'HttpOnly' Flag

Every one of the 35 is a mark on the map. Named now: 1 to 26, most at risk first.

1. TRUfusion Enterprise <= 7.10.4.0 - Authentication BypassCVE-2025-27223Rocketsoftware · CVSS 7.5 · 2.2% likely
2. Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obt…CVE-2020-27658Synology · CVSS 7.1 · 1.3% likely

   Synology

3. Missing HTTPOnly flag on sensitive cookie in TopEaseCVE-2021-42115Business-DNA Solutions GmbH · CVSS 8.1 · 1.3% likely

   Business-DNA Solutions GmbH

4. Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it.CVE-2019-8283Sentinel LDK RTE · 1.2% likely
5. Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlteCVE-2021-3706pi-hole · CVSS 7.4 · 1.1% likely

   Pi-hole

6. An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag…CVE-2022-25172InHand Networks · CVSS 7.5 · 1.0% likely

   InHand Networks

7. Autologin cookie accessible by scriptsCVE-2021-39210glpi-project · CVSS 6.5 · 1.0% likely

   GLPI

8. Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag.CVE-2020-6267SAP SE · CVSS 6.3 · 0.8% likely

   SAP

9. Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradiusCVE-2022-4630lirantal · CVSS 5.3 · 0.7% likely

   Lirantal

10. nsupdate.info CSRF Cookie base.py cookie httponly flagCVE-2019-25091nsupdate.info · CVSS 3.7 · 0.7% likely
11. Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)CVE-2022-21939Johnson Controls · CVSS 7.5 · 0.5% likely

    Johnson Controls

12. Cookie Without HTTPOnly Flag Set VulnerabilityCVE-2024-41685SyroTech · CVSS 6.9 · 0.5% likely

    SyroTech

13. sambitraj Student-Management-System session_start cookie httponly flagCVE-2026-82697sambitraj · CVSS 3.7 · 0.5% likely

    Sambitraj

14. Security Misconfiguration Vulnerability in CP Plus RouterCVE-2025-0479CP Plus · CVSS 8.6 · 0.5% likely

    CP Plus

15. Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' FlagCVE-2024-6739Openfind · CVSS 5.3 · 0.4% likely

    Openfind

16. An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.CVE-2025-26844Znuny · CVSS 9.8 · 0.4% likely

    Znuny

17. CVE-2025-27453Endress+Hauser · CVSS 5.3 · 0.4% likely

    Endress+Hauser

18. IBM Security Directory Integrator information disclosureCVE-2022-33167IBM · CVSS 3.7 · 0.4% likely

    IBM

19. IBM Aspera Console information disclosureCVE-2022-43845IBM · CVSS 3.7 · 0.4% likely

    IBM

20. OpenAM Insecure SSO Cookie InitializationCVE-2026-53660OpenIdentityPlatform · CVSS 7.4 · 0.4% likely

    OpenIdentityPlatform

21. Session Cookies Missing HttpOnly AttributeCVE-2026-0696ConnectWise · CVSS 6.5 · 0.4% likely

    ConnectWise

22. Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless RoutersCVE-2026-22081Tenda · CVSS 8.8 · 0.4% likely

    Tenda

23. Session cookies attribute not set properlyCVE-2023-4217Moxa · CVSS 3.1 · 0.4% likely

    Moxa

24. Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' FlagCVE-2025-24318Dario Health · CVSS 6.8 · 0.4% likely

    Dario Health

25. ioLogik 4000 Series: Session Cookies Attribute Not Set ProperlyCVE-2023-4228Moxa · CVSS 3.1 · 0.3% likely

    Moxa

26. Cookie missing HttpOnly flagCVE-2025-49189SICK AG · CVSS 5.3 · 0.3% likely

    SICK AG

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.