{"action":"Upgrade nsupdate to 0.13.0 or later.","affected":[{"fixed":"0.13.0","introduced":"0"}],"component":"nsupdate","cve_ids":["CVE-2019-25091"],"ecosystem":"PyPI","epss":0.0067,"exploited":false,"fixed_versions":["0.13.0"],"ghsa_id":"GHSA-mwvp-qr62-cvjx","id":"tcs_01M5KHE56PM5CQTZN5HNDYR2Z4","modified_at":"2026-07-07T11:45:15.788297560Z","published_at":"2026-07-07T10:17:26.209197Z","references":["https://osv.dev/vulnerability/PYSEC-2026-885","https://nvd.nist.gov/vuln/detail/CVE-2019-25091","https://github.com/nsupdate-info/nsupdate.info/pull/410","https://github.com/nsupdate-info/nsupdate.info/commit/60a3fe559c453bc36b0ec3e5dd39c1303640a59a","https://github.com/nsupdate-info/nsupdate.info","https://vuldb.com/?ctiid.216909","https://vuldb.com/?id.216909","https://pypi.org/project/nsupdate","https://github.com/advisories/GHSA-mwvp-qr62-cvjx"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-885","url":"https://osv.dev/vulnerability/PYSEC-2026-885"}],"summary":"nsupdate.info has Sensitive Cookie Without 'HttpOnly' Flag"}