CWE-1275 · Cross-Site Request Forgery
Sensitive Cookie with Improper SameSite Attribute
13CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
13 CVEs with CWE-1275 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-6611Incorrect handling of SameSite cookiesMozilla · Firefox · CVSS 9.8 · 2024-07-09 | 9.8 | 0.7% | 2024-07-09 |
| CVE-2023-53957Kimai 1.30.10 SameSite Cookie Vulnerability Session HijackingKimai · Kimai · CVSS 9.8 · 2025-12-19 | 9.8 | 0.6% | 2025-12-19 |
| CVE-2023-30674Improper configuration in Samsung Internet prior to version 21.0.0.41 allows attacker to bypass SameSite Cookie.Samsung Mobile · Samsung Internet · CVSS 6.5 · 2023-07-06 | 6.5 | 0.6% | 2023-07-06 |
| CVE-2022-38386IBM Cloud Pak for Security information disclosureIBM · Cloud Pak for Security · CVSS 5.9 · 2024-05-01 | 5.9 | 0.5% | 2024-05-01 |
| CVE-2026-47889Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponseSpring · Spring Framework · CVSS 7.5 · 2026-08-27 | 7.5 | 0.4% | 2026-08-27 |
| CVE-2026-55688AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeCookieStoreAsyncHttpClient · async-http-client · CVSS 4 · 2026-07-01 | 4.0 | 0.3% | 2026-07-01 |
| CVE-2025-36134IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosureIBM · Sterling B2B Integrator · CVSS 3.7 · 2025-11-25 | 3.7 | 0.3% | 2025-11-25 |
| CVE-2026-107280AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukAsyncHttpClient · async-http-client · CVSS 6.9 · 2026-10-07 | 6.9 | 0.3% | 2026-10-07 |
| CVE-2024-42212HCL BigFix Compliance is affected by an improper or missing SameSite attributeHCL Software · HCL BigFix Compliance · CVSS 5.4 · 2025-05-05 | 5.4 | 0.3% | 2025-05-05 |
| CVE-2025-52628HCL AION is susceptible to Missing SameSite vulnerabilityHCL · AION · CVSS 4.6 · 2026-02-03 | 4.6 | 0.2% | 2026-02-03 |
| CVE-2024-30155HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerabilityHCL Software · HCL SX · CVSS 5.5 · 2025-03-26 | 5.5 | 0.2% | 2025-03-26 |
| CVE-2024-43173IBM Concert information disclosureIBM · Concert · CVSS 3.7 · 2024-10-22 | 3.7 | 0.2% | 2024-10-22 |
| CVE-2025-24387Missing CSRF protectionOTRS AG · OTRS · CVSS 4.8 · 2025-03-10 | 4.8 | 0.2% | 2025-03-10 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.