medium · CVSS v3 4.2 · CVSS v4 2.3

CVE-2026-123535

Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie…

Description

Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.2
CVSS v4
2.3
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-123992

A flaw has been found in DataEase up to 2.10.27. Affected by this issue is the function StaticResourceServer.validateSvgContent of the file core/core-backend/src/main/java/io/dataease/visualization/server/StaticResourceServer.java of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 2.10.28 can resolve this issue. This patch is called 0709fe98d6608c3507daee3e92cf433e7ff61370. You should upgrade the affected component. The vendor confirms: "The reported tab/entity-based URL bypass is covered by our previously implemented SVG security hardening. The fix replaces the blacklist-based checks with namespace-aware element and attribute allowlists, restricts permitted references to document-local fragments, and applies a restrictive Content Security Policy to uploaded SVG responses.

View analysis

medium

CVE-2026-97194

The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

View analysis

medium

CVE-2026-124326

A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upload. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published and may be used. The researcher claims to have submitted a GHSA on the repository of the project.

View analysis

medium

CVE-2026-123493

Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot users. Because token validation only checks the bot's own status, attackers holding pre-minted bot tokens can keep reading and modifying shared projects via the HTTP API, CalDAV, MCP and feeds.

View analysis