GHSA-5j35-xr4g-vwf4
NoneCVSS
—
EPSS
—
Published
Mar 25, 2026
CISA due date
—
The record
@grackle-ai/server has a Missing Secure Flag on Session Cookie
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @grackle-ai/server | 0 | 0.70.5 |
Related vulnerabilities
- GHSA-8g29-8xwr-qmhr @grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig… Also affects @grackle-ai/server
- GHSA-3mjm-x6gw-2x42 @grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers Also affects @grackle-ai/server
- GHSA-w3hv-x4fp-6h6j @grackle-ai/server has Missing WebSocket Origin Header Validation Also affects @grackle-ai/server
- GHSA-7q9x-8g6p-3x75 @grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template Also affects @grackle-ai/server
- CVE-2026-65655 When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy… CWE-614
- CVE-2026-46550 NocoDB is software for building databases as spreadsheets. CWE-614
- CVE-2026-53661 Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid… CWE-614
- CVE-2026-11956 A vulnerability was determined in TwiN gatus 5.36.0. CWE-614