CVE-2026-86487: Incorrect Authorization

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

Exploit for Server-Side Request Forgery in Vercel Next.Js

CVE-2026-44578 — Next.js WebSocket Upgrade SSRF Laboratorio...

Malicious code in date-fns-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9839e9520db45a2a739a415767a8258e15afee65cee71fe5ff41777cbd22450 The package impersonates the popular date-fns library. Its main module, date-fns-formatter.js, contains a small formatDate shim as a decoy in front o...

MAL-2026-15974 Malicious code in date-fns-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9839e9520db45a2a739a415767a8258e15afee65cee71fe5ff41777cbd22450 The package impersonates the popular date-fns library. Its main module, date-fns-formatter.js, contains a small formatDate shim as a decoy in front o...

OESA-2026-3694 libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing...

OESA-2026-3695 libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing...

OESA-2026-3692 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTT...

CVE-2026-86188

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

CVE-2026-86188 AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

CVE-2026-86188 AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

CVE-2026-86188

AVideo installations with the YPTSocket plugin enabled are affected by an unauthenticated cross-site scripting (XSS) vulnerability. Attackers can send crafted WebSocket messages whose callback names resolve to global functions such as avideoConfirmHTML, which assign untrusted data to innerHTML, e...

EUVD-2026-72009

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

CVE-2026-86188 AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

resterm v1.5.6

Resterm An API-as-code workbench for the terminal. resterm.app · docs Resterm is an API client that uses .http/.rest files as source code. Almost all the features live in .http files, so they are easy to review in Git or any other version control. You can send requests, test API flows, record HTT...

SUSE CVE-2026-3433

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 fail to restrict roleupdated websocket event broadcasts to members of the affected team or channel which allows an authenticated attacker with guest-level access to observe permission scheme change...

SUSE CVE-2026-67448

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

SUSE CVE-2026-84381

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/sync/socksproxy.py and src/httpcore2/httpcore2/async/socksproxy.py when the remote origin uses wss through a SOCKS5 proxy because the TLS upgrade condition only recognizes...

CVE-2026-86188: Improper Neutralization of Input During Web Page Generation

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

PT-2026-86413

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data Vulnerability Details CVEID:CVE-2026-9675 DESCRIPTION: Impact: The undici WebSocket client enforces maxPayloadSize per-frame but does not enforce the cumulative size of fragmented uncompress...