CVE-2026-47360

HighCVSS 7.5/10Last modified Oct 2, 2026

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.

  When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Oct 1, 2026
Last modified
Oct 2, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-473616.4In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SECVE-2026-473624.6In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LCVE-2026-473636.3In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied CVE-2026-473646.5In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no userCVE-2026-473659.9Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass croCVE-2026-473667.2Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticatCVE-2026-473679.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID EnterpCVE-2026-473688.6A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtaiCVE-2026-473699.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain deCVE-2026-47377.3Use After Free vulnerability in No-Chicken Echo-Mate (‎SDK/rv1106-sdk/sysdrv/source/kernel/mm modules). This vulnerability is associated witCVE-2026-473709.9A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain deCVE-2026-473729.1Crypt::SaltedHash versions through 0.09 for Perl generate insecure random values for salts. These versions use the built-in rand function,
CVE-2026-47360: High severity, CVSS 7.5 | Vulnix