CVE-2026-86077: Missing Authorization

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

Linux Distros Unpatched Vulnerability : CVE-2026-19204

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and...

EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-3278)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-3353)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 PoC Summary Marimo = 0.20.4 is affected...

CVE-2026-86487

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

SUSE CVE-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...

EUVD-2026-72503

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

CVE-2026-86487

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

CVE-2026-86487

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

CVE-2026-86487

In JetBrains YouTrack versions before 2026.2.18634 , a crafted WebSocket message allowed read-only whiteboard users to modify canvas content. The flaw is an integrity issue: users who should have had read-only access could alter whiteboard drawings. The CVSS 3.1 score is 3.1 (LOW) , reflecting a ...

Sensitive Information Disclosure

org.springframework, spring-webflux is vulnerable to sensitive information disclosure. The vulnerability is due to request headers being included in the exception reason when handling WebSocket connections, which allows an attacker to potentially obtain indirectly sensitive user information by...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its WebSocket frame parsing, where a frame carrying an unknown opcode bypasses the maximum frame size validation and its declared payload length is allocated before the opcode is...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

DEBIAN-CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

UBUNTU-CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

EUVD-2026-72335

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CVE-2026-19204

Eclipse Jetty is vulnerable in its WebSocket component when auto-fragmentation is enabled. A remote, unauthenticated client can send a WebSocket frame with an unknown opcode and a very large declared payload length. Because unknown opcodes bypass the normal maximum frame size handling and payload...