PT-2026-94083

Name of the Vulnerable Software and Affected Versions browserless versions 1.44.0 through 2.56.7 Description Authenticated token holders can read arbitrary files accessible to the container process because the software fails to enforce file protocol restrictions in Playwright websocket endpoints...

CVE-2026-61596: Authorization Bypass Through User-Controlled Key

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry...

Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service CVE-2026-15709 libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denia...

CVE-2026-92800: Insufficient Session Expiration

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...

CVE-2026-61599: Use of Externally-Controlled Input to Select Classes or Code

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

PT-2026-93856

Name of the Vulnerable Software and Affected Versions GPAC version 26.07.0 Description A heap-based buffer overflow exists in the WebSocket Handler component within the rmt client handle ws frame function of the src/utils/rmt ws.c file. This issue can be triggered remotely by manipulating the...

PT-2026-94124

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description djust allows an unauthenticated WebSocket or SSE client to trigger the import and execution of the top-level code of any importable Python module. This occurs because the live transport resolves the...

RHEL 9 : libsoup (RHSA-2026:68234)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68234 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...

ALSA-2026:68234 Moderate: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup: WebSocket permessage-deflate Unbounded Decompression Remote Denial of Service CVE-2026-15709 libsoup: SoupWebsocketConnection: libsoup: WebSocket remote denia...

CVE-2026-61589: Use of Less Trusted Source

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket handlemount and ViewRuntime.buildrequest rebuild an HttpRequest via RequestFactory.get... with no HTTPHOST, so request.gethost defaulted to...

CVE-2026-92811: Exposure of Sensitive Information to an Unauthorized Actor

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container...

PT-2026-93887

Impact djust.mixins.model binding.ModelBindingMixin provides a default update model event handler and is part of the LiveView base MRO, so every LiveView exposes it. It setattrs a view attribute whose name is client-supplied field, gated only by: reject -prefixed names; reject a 14-entry denylist...

CVE-2026-92399: Heap-based Buffer Overflow

A vulnerability was determined in GPAC 26.07.0. This affects the function rmtclienthandlewsframe of the file src/utils/rmtws.c of the component WebSocket Handler. Executing a manipulation of the argument payloadsize can lead to heap-based buffer overflow. It is possible to launch the attack...

RHEL 10 : libsoup3 (RHSA-2026:68235)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68235 advisory. Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup,...

ALSA-2026:68235 Important: libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications...

PT-2026-94074

Name of the Vulnerable Software and Affected Versions Docs versions prior to 5.4.1 Description An issue exists where websocket collaboration connections are not properly revoked when access is removed at the parent document level. This allows users whose access has been revoked to maintain...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS through the WebSocket decoder process. An attacker can exhaust server memory by sending oversized frames or fragmented messages without size limits. Details Denial of Service DoS describes a family of attacks, all...

CVE-2026-83480

Vulnerability in the Helidon product of Oracle Fusion Middleware component: WebSocket. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerabilit...