Moderate: Red Hat Security Advisory: libsoup security update

An update for libsoup is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-63330: Improper Authorization

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

PT-2026-96220

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.25.6 Description The api get recording stream function in warpgate-admin/src/api/recordings detail.rs fails to enforce the AdminPermission::RecordingsView requirement for the...

RHEL 9 : libsoup (RHSA-2026:69297)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69297 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...

RHEL 9 : libsoup (RHSA-2026:69108)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69108 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...

SUSE SLED15 / SLES15 Security Update : python-aiohttp (SUSE-SU-2026:4031-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4031-1 advisory. - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without...

CVE-2026-94111

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...

CVE-2026-94111 Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...

CVE-2026-94111 Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...

CVE-2026-94111

Tencent BrowserSkill through 0.3.0 contains an authentication bypass in the local daemon WebSocket origin validation . The flawed logic accepts any chrome-extension origin whose identifier is 32 characters long and falls within the range a-p , allowing an attacker to register a malicious browser ...

EUVD-2026-83733

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...

CLEANSTART-2026-SV46004 client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap

Security vulnerability affects the apache-nifi package. A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap...

PT-2026-95967

Name of the Vulnerable Software and Affected Versions Tencent BrowserSkill versions prior to 0.3.1 Description An authentication bypass exists in the local daemon WebSocket origin validation. The system incorrectly accepts any chrome-extension origin consisting of 32 characters within the range...

CVE-2026-94111: Origin Validation Error

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the onFrameData function in protocol.py, where the maxMessagePayloadSize limit is enforced against the compressed wire size of a permessage-compressed WebSocket frame rather than...

Allocation of Resources Without Limits or Throttling

Overview crossbar is a Crossbar.io multi-protocol WAMP/WebSocket, REST/HTTP, MQTT application router for microservices. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the onFrameData function in protocol.py, where the...

CVE-2026-93839

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pdregister WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket...

DEBIAN-CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

UBUNTU-CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...