PT-2026-96790

Name of the Vulnerable Software and Affected Versions Frigate versions prior to 0.17.2 Description The WebSocket handler in frigate/comms/ws.py forwards message topics to the dispatcher without verifying the authenticated user's role. This occurs because the nginx authentication subrequest lacks...

PT-2026-96329

Name of the Vulnerable Software and Affected Versions Gigatech PDV5701 version 1.0.31 240305 112640 Description An issue exists in the WebSocket Service component where improper processing of the /index.html endpoint allows remote attackers to bypass authentication. Recommendations At the moment,...

CVE-2026-83599: Improper Handling of Highly Compressed Data (Data Amplification)

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocketclientdecompressmessage to grow decompressed output toward...

CVE-2026-63330

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-62247

Supabase Realtime (prior to 2.111.2 ) contains an incorrect authorization flaw in its per-extension presence.read row-level security (RLS) policy enforcement. When a private-channel client is granted presence.write but explicitly denied presence.read , the client can still receive presence_diff m...

CVE-2026-63330

Warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux, is affected by a missing authorization check prior to version 0.25.6 . The api_get_recording_stream function in warpgate-admin/src/api/recordings_detail.rs protects the recording stream WebSocket endpoint with only session aut...

EUVD-2026-84061

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-63330 Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-63330 Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-63330 Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-63329 Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

SUSE CVE-2026-72810

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including...

Moderate: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

CVE-2026-19204

A flaw was found in Jetty. A remote attacker can exploit this vulnerability by sending a specially crafted WebSocket frame with an unknown operation code opcode and a very large declared payload length. When auto-fragmentation is enabled, these unknown opcodes bypass the normal maximum frame size...

Moderate: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

SUSE SLED15 / SLES15 Security Update : python-aiohttp (SUSE-SU-2026:4031-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4031-1 advisory. - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without...

RHEL 9 : libsoup (RHSA-2026:69297)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69297 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...

RHEL 9 : libsoup (RHSA-2026:69108)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69108 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...

CVE-2026-63330: Improper Authorization

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...