CVE-2026-81558

A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files...

EUVD-2026-124202

A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files...

CVE-2026-81558

A missing authorization vulnerability exists in the SocketIo API of Synology DiskStation Manager (DSM) . This flaw affects versions prior to 7.3.2-86009-5 and 7.4.1-90080 , potentially allowing remote authenticated users to write specific files. The vulnerability is categorized under CWE-862 . No...

CVE-2026-81558

A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files...

PT-2026-145690

A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files...

CVE-2026-81558: Synology DiskStation Manager (DSM): A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5…

A missing authorization vulnerability in the SocketIo API in Synology DiskStation Manager DSM before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files...

CVE-2025-61765_PoC

Summary A remote code execution vulnerability in python-socketio versions prior to 5.14.0 allows attackers to execute arbitrary Python code through malicious pickle deserialization in multi-server deployments on which the attacker previously gained access to the message queue that the servers use...

ROOT-APP-NPM-CVE-2024-38355 CVE-2024-38355 in socket.io - Patched by Root

Root has patched CVE-2024-38355 in the socket.io package for Root:npm. Multiple fixed versions available...

com.corundumstudio.socketio:netty-socketio (2.0.14), com.erudika:para-cache-hazelcast (>=1.41.5, <=1.43.0) +221 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (5.6.0)

com.hazelcast:hazelcast MAVEN version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.corundumstudio.socketio:netty-socketio 2.0.14 - com.erudika:para-cache-hazelcast =1.41.5, =1.8.0, =3.2.3,...

android_poc_tester

androidenv — Dockerized Android CTF POC Runner A platform fo...

CVE-2026-25254

Improper authorization leads to Remote Code Execution via SocketIO interface...

EUVD-2026-84344

Improper authorization leads to Remote Code Execution via SocketIO interface...

CVE-2026-25254

CVE-2026-25254 is a critical (CVSS 9.8) improper authorization vulnerability in Qualcomm Software Center (QSC family) , where deficiencies in the authentication process via the SocketIO interface allow a remote, unauthenticated attacker to achieve Remote Code Execution with high impact on confide...

CVE-2026-25254 Improper authorization in Qualcomm Software Center

Improper authorization leads to Remote Code Execution via SocketIO interface...

CVE-2026-25254 Improper authorization in Qualcomm Software Center

Improper authorization leads to Remote Code Execution via SocketIO interface...

CVE-2026-25254: Improper Authorization

Improper authorization leads to Remote Code Execution via SocketIO interface...

Malicious code in lint-nuxtjs-babel-socketio (npm)

Source: amazon-inspector 1a8611eb2223c19e3229ffc9e93992299b19a837631cc58ec018759f33681b70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in less-socketio-loglevel-carpo (npm)

Source: amazon-inspector 260abb768f8062126b91ed7c1e0822ea7d2cd0490e64c0ef6d0235f618e5ccf1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lacerta-html-webpack-plugin-socketio-jabbah (npm)

Source: amazon-inspector a63dbc92d7357f2dc4da01f1acf0624b6e8e6e4639bca26a33abcb901e3057f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lacerta-apex-weywot-socketio (npm)

Source: amazon-inspector d5af945fd83b51e0b4e1ef98ceeb87b03d2659cd4bdf13b320dc9ad61431285f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...