CVE-2026-121554Medium· 5.9▾ Sunlitcordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a re…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions.
cordova-plugin-advanced-http >= 1.5.0 <= 3.3.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123513Medium· 6.8Vikunja before 2.7.1 Auth Token Leak via API URL Change
CVE-2026-123551Critical· 10.0OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket
CVE-2026-119465Medium· 5.3WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability
CVE-2026-71863Low· 2.6SecureDrop: Onion Service client auth credentials copied to Monitor Server
CVE-2023-34968Medium· 5.3Samba: spotlight server-side share path disclosure
CVE-2026-12547Low· 3.4Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch