CVE-2026-119416Medium· 4.8▾ SunlitCakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars.
cakephp <= 5.4.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119419High· 8.1CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation
CVE-2026-119415Low· 3.7CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type
CVE-2026-79752Critical· 9.2CakePHP is a rapid development framework for PHP
CVE-2026-61546High· 8.8AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools
CVE-2026-118651Medium· 5.3Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
CVE-2026-115413High· 7.8AWS API MCP Server OAuth Token Audience Validation Bypass