CVE-2026-111617

WHartTest through 2.8.1 contains a missing authentication vulnerability in its UI-Automation WebSocket endpoints . Specifically, the UiAutomationConsumer accepts all connections, allowing unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ endpoints. An attacker can regis...

CVE-2026-111617 WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id ...

CVE-2026-111617

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id ...

EUVD-2026-103039

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id ...

CVE-2026-111617 WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id ...

CVE-2026-111617 WHartTest through 2.8.1 Missing Authentication on UI-Automation WebSocket Endpoints

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id ...

CLSA-2026-1792164186 TuxCare security update for ws (3 CVEs)

TuxCare rebuilt ws to address 3 CVEs. Fixed in 7.4.3-tuxcare.1...

CLSA-2026-1792164080 TuxCare security update for ws (1 CVE)

TuxCare rebuilt ws to address 1 CVE. Fixed in 7.5.10-tuxcare.1...

CLSA-2026-1792163981 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 2.3.1-tuxcare.1...

CLSA-2026-1792162153 TuxCare security update for web3-providers-ws (1 CVE)

TuxCare rebuilt web3-providers-ws to address 1 CVE. Fixed in 1.10.4-tuxcare.1...

CLSA-2026-1792162063 TuxCare security update for @vitest/ws-client (1 CVE)

TuxCare rebuilt @vitest/ws-client to address 1 CVE. Fixed in 3.2.4-tuxcare.4...

CLSA-2026-1792162062 TuxCare security update for @vitest/ws-client (1 CVE)

TuxCare rebuilt @vitest/ws-client to address 1 CVE. Fixed in 3.2.4-tuxcare.3...

CLSA-2026-1792162060 TuxCare security update for @vitest/ws-client (2 CVEs)

TuxCare rebuilt @vitest/ws-client to address 2 CVEs. Fixed in 3.2.4-tuxcare.2...

CLSA-2026-1792161972 TuxCare security update for @nestjs/platform-ws (2 CVEs)

TuxCare rebuilt @nestjs/platform-ws to address 2 CVEs. Fixed in 11.2.3-tuxcare.1...

CLSA-2026-1792161971 TuxCare security update for @nestjs/platform-ws (2 CVEs)

TuxCare rebuilt @nestjs/platform-ws to address 2 CVEs. Fixed in 11.2.2-tuxcare.1...

CLSA-2026-1792161970 TuxCare security update for @nestjs/platform-ws (1 CVE)

TuxCare rebuilt @nestjs/platform-ws to address 1 CVE. Fixed in 10.4.22-tuxcare.3...

CLSA-2026-1792161969 TuxCare security update for @nestjs/platform-ws (2 CVEs)

TuxCare rebuilt @nestjs/platform-ws to address 2 CVEs. Fixed in 10.4.22-tuxcare.1...

CVE-2026-111383

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-111383

The Nezha monitoring tool (versions 2.0.13 before 2.3.15 ) is vulnerable to a resource exhaustion flaw. Authenticated users can exploit the /api/v1/ws/transfer WebSocket endpoint to open unbounded concurrent connections. Specifically, the ServerTransferClass.Subscribe function allows the creation...

CVE-2026-111383 Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...