CVE Watch24 jul 2026

CVE-2026-35536

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cook

CVSS

7.2

Alto

EPSS

0.2%

p15

KEV

—

Exploit Today

0-100

Publicado: 3 abr 2026 · Última mod.: 24 jul 2026 · CWE-159

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-08-072026-09-04

Descripción técnica

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-619843.6 BAJ

19.6%

——6ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)53d