Skip to content

Vendor

hotwired vulnerabilities

1 published CVE affecting hotwired, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
0
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of hotwired alerts

Products

Latest hotwired CVEs

Newest publication first

  1. CVE-2025-66803 Turbo Frame responses can restore stale session cookies

    Published
    MediumCVSS 4.8 EPSS 0.28%

    Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responses reapply session cookies after logout. This can be exploited by remote attackers via selective network delays (e.g. delaying requests base...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.