CVE-2026-90938 LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket

LangBot's plugin runtime pip package langbotplugin through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 /plugin/ws whose authentication is gated on plugindebugkey, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose which...

CVE-2020-3495

Cisco Jabber is vulnerable to Cross Site Scripting XSS through XHTML-IM messages. The application does not properly sanitize incoming HTML messages and instead passes them through a flawed XSS filter. Recent assessments: wvu-r7 at September 03, 2020 7:38pm UTC reported: This XSS combined with...