Any cookies that are passed through the proxy can be considered exposed. This is basically any cookie associated with any request (page, image, etc.) or submission (forms, etc.) your browser processes.
There are some tricks to get browsers to pass along unrelated cookies. MDN's page on HTTP Cookies gives an example originally from Wikipedia:
Cross-site request forgery (CSRF)
Wikipedia mentions a good example for CSRF. In this situation, someone includes an image that isn’t really an image (for example in an unfiltered chat or forum), instead it really is a request to your bank’s server to withdraw money:
Now, if you are logged into your bank account and your cookies are still valid (and there is no other validation), you will transfer money as soon as you load the HTML that contains this image.
By guessing common sites, it would be possible for a page to use this technique to get the browser to send, along with the request, a cookie containing an active session key even if the requested content were invalid. The proxy could then pick up the cookie and make use of it.
HTTPS can help mitigate all of this, but it depends on how the particular proxy works. Proxies can perform MITM attacks on the connection by replacing the SSL certificate with another, trusted certificate.
Modern browsers offer the ability to open a "privacy" window or tab that behave as though there are no previous cookies in existence (among other things). None of your pre-existing cookies are shared with the private window.