PT-2026-61563

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description A denial of service issue exists in the RPC use handler that causes a panic when the db variable is set without a namespace. Unauthenticated attackers can crash the server process by sending a...

PT-2026-61566

SurrealDB versions before 3.1.0 fail to apply the SURREAL WEBSOCKET MAX MESSAGE SIZE limit to anonymous /sql WebSocket connections, allowing attackers to buffer unbounded frames in the per-connection read buffer. Attackers can stream WebSocket frames larger than the configured limit across multip...

PT-2026-61576

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description The value and JSON parser fails to enforce the configured recursion depth limit when processing nested braces, brackets, or parentheses. Unauthenticated attackers can exploit this by sending deeply...

Denial Of Service (DoS)

websocket-driver is vulnerable to Denial Of Service DoS. The vulnerability is due to the lack of limits on processing HTTP request or response headers during the WebSocket handshake, which allows an attacker to send an endless list of headers and exhaust the receiving process's memory, resulting ...

Improper Origin Validation

MCP Python SDK is vulnerable to Improper Origin Validation. The vulnerability is due to the WebSocket transport accepting handshake requests without validating the Host or Origin headers, which allows an attacker to establish unauthorized cross-origin WebSocket connections...

Directory Traversal

Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Directory Traversal via the WebSocket routing. An attacker can access unintended upstream endpoints by sending crafted WebSocket upgrade requests containing path traversal...

CVE-2026-16119

A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/execapproval.go of the component WebSocket Approval Endpoint. Performing a manipulation results in incorrect authorization. The attack is possible to be carried...

CVE-2026-15631

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which...

CVE-2026-16119 nextlevelbuilder GoClaw WebSocket Approval Endpoint exec_approval.go RequestApproval authorization

A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/execapproval.go of the component WebSocket Approval Endpoint. Performing a manipulation results in incorrect authorization. The attack is possible to be carried...

CVE-2026-16119

A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/execapproval.go of the component WebSocket Approval Endpoint. Performing a manipulation results in incorrect authorization. The attack is possible to be carried...

CVE-2026-16119

CVE-2026-16119 affects nextlevelbuilder GoClaw up to 3.13.2, specifically the WebSocket Approval Endpoint’s internal/tools/exec_approval.go, function RequestApproval. A manipulation can cause incorrect authorization, and the attack can be carried out remotely. The exploit has been made public, wi...

EUVD-2026-45378

A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/execapproval.go of the component WebSocket Approval Endpoint. Performing a manipulation results in incorrect authorization. The attack is possible to be carried...

CVE-2026-15631 @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which...

CVE-2026-15631 @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which...

CVE-2026-15631 @fastify/http-proxy vulnerable to prefix escape via WebSocket path traversal

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which...

CVE-2026-15631

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which...

EUVD-2026-45375

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which...

CVE-2026-15631

Summary (supported by provided sources): The CVE-2026-15631 issue affects @fastify/http-proxy versions 9.4.0 to 11.5.0, where the WebSocket routing logic in WebSocketProxy.findUpstream validates the destination path against the rewrite prefix but relies on the WHATWG URL constructor, which collap...

SUSE-SU-2026:22819-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption...

OPENSUSE-SU-2026:21372-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption...