Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-1275
Weakness type CWE-1275 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 23 | 22 | 0 |
Monthly trend
▂▁▁▁▁█▁▂▃▃▂
2025-12 1 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 13 · 2026-06 0 · 2026-07 1 · 2026-08 3 · 2026-09 3 · 2026-10 2
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2023-53957 | 8.5 | 47.2 | — | Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking |
| CVE-2026-69215 | 6.8 | 41.8 | — | Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin |
| CVE-2026-47889 | 7.5 | 35.6 | — | Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse |
| CVE-2026-53660 | 7.4 | 33.7 | — | OpenAM Insecure SSO Cookie Initialization |
| CVE-2026-55688 | 4.0 | 24.6 | — | AsyncHttpClient: Cookie stored for an unrelated domain (cookie tossing) via ThreadSafeC… |
| CVE-2026-107229 | 4.0 | 16.6 | — | AsyncHttpClient: Incomplete origin checks in the default cookie store allow cookie toss… |
| CVE-2026-107280 | 6.9 | 16.6 | — | AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list,… |
| CVE-2026-73847 | 6.8 | 11.4 | — | Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database comp… |
| CVE-2026-8409 | 2.3 | 11.0 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
| CVE-2026-8410 | 2.3 | 11.0 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
| CVE-2026-8411 | 2.3 | 8.6 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
| CVE-2026-8412 | 2.3 | 8.6 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
| CVE-2026-8413 | 2.3 | 8.6 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
| CVE-2026-8414 | 2.3 | 8.6 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
| CVE-2026-8415 | 2.3 | 8.6 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
| CVE-2026-8416 | 2.3 | 8.6 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
| CVE-2026-8427 | 2.3 | 8.6 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
| CVE-2026-8432 | 2.3 | 8.6 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
| CVE-2026-8433 | 2.3 | 8.6 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
| CVE-2026-8434 | 2.3 | 8.6 | — | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concr… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| concrete cms | 13 |
| asynchttpclient | 3 |
| emlog | 1 |
| hatchet-dev | 1 |
| honojs | 1 |
| http4s | 1 |
| kimai | 1 |
| openidentityplatform | 1 |
| spring | 1 |
