CVE-2026-35536Medium· 5.4▾ SunlitA flaw was found in Tornado. A remote attacker could exploit this vulnerability by injecting specially crafted characters into the `domain`, `path`, and `samesite` arguments when setting cookies. This could lead to cookie attribute injecti…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
5.4 → 7.2
medium → high
7.2 → 5.4
high → medium
5.4 → 7.2
medium → high
7.2 → 5.4
high → medium
5.4 → 7.2
medium → high
7.2 → 5.4
high → medium
0.2% → 0.3%
Last analysed / modified upstream
A flaw was found in Tornado. A remote attacker could exploit this vulnerability by injecting specially crafted characters into the domain, path, and samesite arguments when setting cookies. This could lead to cookie attribute injection, potentially allowing for information disclosure or manipulation of client-side data.
tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments — rated Moderate by Red Hat. Released 2026-04-03, updated 2026-10-16.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:24342 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:20577 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:13641
Affected packages:
tornado < 6.5.5Patched in:
tornado 6.5.5Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42215High· 7.5GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks (CVE-2026-42215)
CVE-2026-28684High· 7.1python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following (CVE-2026-28684)
CVE-2026-34445High· 7.3ONNX: ONNX: Denial of Service and potential information disclosure via malicious model metadata (CVE-2026-34445)
CVE-2026-42284High· 7.5GitPython: GitPython: Arbitrary code execution via improper validation of clone options (CVE-2026-42284)
CVE-2026-67323High· 8.4GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command exe…
CVE-2025-59425High· 7.5vllm: Timing Attack in vLLM API Token Verification Leading to Authentication Bypass (CVE-2025-59425)