cve-2026-69243-poc-aiohttp-smuggling

CVE-2026-69243 — aiohttp Request Smuggling CWE-444 Request smuggling via rejected WebSocket upgrade in aiohttp Or build the Rust version zero dependencies, std only: git clone https://github.com/JVBotelho/cve-2026-69243-poc-aiohttp-smuggling cd cve-2026-69243-poc-aiohttp-smuggling/poc cargo build...

CVE-2026-39363

CVE-2026-39363 — Vite Dev Server Arbitrary File Read PoC A drop-in PoC for GHSA-p9ff-h696-f583. It reads arbitrary files from the machine running the dev server by calling fetchModule over an unauthenticated HMR WebSocket, bypassing the HTTP-layer server.fs.allow restriction. Affected Versions...

gotestwaf

GoTestWAF GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, SOAP, XMLRPC, and others. It was designed to evaluate web application security solutions, such as API security proxies, Web Application Firewalls, IPS, API...

nextssrf

╔══════════════════════════════════════════════════════════════╗ ║ NextSSRF — CVE-2026-44578 Scanner & Exploit ║ ║ Next.js WebSocket Upgrade Handler SSRF ║ ║ Affected: 13.4.13 → 15.5.15, 16.0.0 → 16.2.4 ║ ║ @mitsec / ynsmroztas — Bug Bounty Tooling ║...

certstream-server-rust

certstream-server-rust A Certstream server written in Rust. It monitors Certificate Transparency CT logs and streams newly issued SSL/TLS certificates over WebSocket and Server-Sent Events SSE. Overview Certstream aggregates certificates from Certificate Transparency logs and streams them in real...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE via Terminal WebSocket / / | / / / | \ / \ \ / / | // / \ / / | | / / // // / / // // \ / Status: Patched in 0.23.0 — marimo-team/marimo@c24d480 Vulnerability The /terminal/ws endpoint lacks the validateauth call present in every other authenticated endpoint...

CVE-2025-51495

I would like to report a security vulnerability identified in the latest release of Mongoose v7.17. The issue resides in the WebSocket module, specifically within the mgwscb function responsible for handling incoming WebSocket frames. The function is vulnerable to an integer overflow, which may...

CVE-2026-39987

⚠️ CVE-2026-39987 — Unauthenticated Shell in marimo 0.23.0 A reactive Python notebook tool gave attackers a full shell in one WebSocket request. 📌 Overview CVE-2026-39987 is a critical pre-auth RCE vulnerability in marimo — a popular open-source reactive notebook for Python modern Jupyter...

grdpwasm

grdpwasm A web-based RDP client built with Go WebAssembly and grdp. Connect to a Windows Remote Desktop server directly from your browser — no plugins required. Architecture Browser WASM ──WebSocket──► proxy Go ──TCP──► RDP Server Because browsers cannot open raw TCP sockets, a lightweight Go pro...

CVE-2020-13935

Exploit for WebSocket Vulnerability in Apache Tomcat CVE-2020-13935 In the corresponding blog post the analysis and exploitation of the vulnerability is explained in detail. Usage Clone the repository, then build the tcdos binary. Run the program as follows to test whether a particular WebSocket...

CVE-2026-39636-vulnerability-exp

1. Burp Suite must be opened before running here !! And the default Burp Suite port must be 8080. If it is different, you can change it yourself. 2. Download the required libraries pip install websockets==16.0 -i https://pypi.tuna.tsinghua.edu.cn/simple 3. Just run it directly CVE-2026-39363...

cve-2025-24035-rds-websocket-dos-test

CVE-2025-24035 WebSocket Stress Test Safe 🚨 DISCLAIMER : This is NOT an exploit. This script is a simulation and should only be used for educational purposes in a safe lab environment. Purpose This test sends a deliberately oversized WebSocket header to simulate a malformed request toward RD...

CVE-2026-116579

A flaw was found in autobahn. An unauthenticated remote attacker can exploit this vulnerability by sending a small, highly compressed WebSocket message to a server configured with Brotli compression. Because decompression occurs without enforcing an output size limit during processing, the payloa...

CVE-2026-46726

CVE-2026-46726 — camel-vertx-websocket Header Injection SSRF + Secret Disclosure Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| WebSocket feed ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 +...

CVE-2026-25253

CVE-2026-25253 OpenClaw 1-Click RCE ★ CVE-2026-25253 OpenClaw 1-Click Remote Code Execution PoC ★ https://github.com/user-attachments/assets/e6957c61-7549-4e68-831e-a05436504a3e Description CVE-2026-25253 : OpenClaw Authentication Token Exfiltration Vulnerability description: OpenClaw aka clawdbo...

CVE-2026-39987

CVE-2026-39987 Exploit POC Overview This repository contains a Proof-of-Concept POC script for CVE-2026-39987, a pre-authentication Remote Code Execution RCE vulnerability in Marimo. The exploit leverages a WebSocket endpoint to execute arbitrary commands on the target system. Vulnerability Detai...

CVE-2022-43704

CVE-2022-43704 - Channel Accessible by Non-Endpoint/Authentication Bypass by Capture-replay Sinilink XY-WFTX Wifi Remote Thermostat Module Temperature Controller Title Product Documentation Application User Manual Hardware Datasheets ESP8285 Buck Converter Firmware Product Description Overview WI...

CVE-2023-31902

CVE-2023-31902 — Mobile Mouse 3.6.0.4 Remote Code Execution Summary: Mobile Mouse is a Windows application that turns your phone into a mouse/keyboard over the network. It listens on port 9099 TCP and 35913 WebSocket with no authentication by default. The vulnerability allows an unauthenticated...

verify-ghsa-c4j6-fc7j-m34r

verify-ghsa-c4j6-fc7j-m34r In-band verifier for GHSA-c4j6-fc7j-m34r / CVE-2026-44578 — Server-Side Request Forgery in Next.js via WebSocket upgrade requests. ⚠️ For authorized security testing only. You are responsible for ensuring you have permission to test every target you pass to this script...

CVE-2026-39987-marimo-rce

CVE-2026-39987 - Marimo Pre-Auth RCE Unauthenticated Remote Code Execution in Marimo via WebSocket Terminal 📌 Overview CVE-2026-39987 is a critical Pre-Authentication Remote Code Execution vulnerability affecting Marimo versions prior to 0.23.0. The /terminal/ws WebSocket endpoint completely...