Malicious code in http-ws-listener (npm)

Source: amazon-inspector 2b70acc8a626218c5855ef656a6945f1f2018c0ff62c112d9b31bae5016fae49 [email protected] ships misc/configFetcher.js, which reconstructs a hidden Pastebin URL and the module names 'net' and 'childprocess' by triple-base64-decoding a Lorem-ipsum string literal and indexing...

sharepoint-2026-poc

SharePoint /trust WS-Federation Deserialization — PoC & Det...

8x8: @jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)

An unsafe nginx regex pattern was discovered in the /colibri-relay-ws/ location of the @jitsi/docker-jitsi-meet project. The regex a-zA-Z0-9-\.+ accepted arbitrary domain names and IP addresses for proxypass directives, allowing unauthenticated requests to be proxied to attacker-specified...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the PolicyBuilder policy parser. An attacker can exhaust runtime memory and crash the application by supplying a policy document with deeply nested policy operators, or a policy structure that drives unbounded...

modconf (0.4.0b2), tlseparation (1.1.3) +4 more potentially affected by CVE-2026-59890 via setuptools (36.0.1)

setuptools PYPI version 36.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - modconf 0.4.0b2 - tlseparation 1.1.3 - ws-sheets =0.5.0b1, =0.4.1b17, =0.1.0b11, =0.1.0b17 Source cves: CVE-2026-59890 Source advisory:...

CVE-2026-55440

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMANDRESULTS handler in ufo/server/ws/handler.py called getorcreatesession in ufo/server/services/sessionmanager.py without ownerclientid, allowing an authenticated client to create ...

CVE-2026-54568

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICEINFOREQUEST with another device's targetid and receive that device's server-side systeminfo through...

CVE-2026-23538

A vulnerability was identified in the Feast Feature Server's "/ws/chat" endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory,...

CVE-2026-54568: Authorization Bypass Through User-Controlled Key

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICEINFOREQUEST with another device's targetid and receive that device's server-side systeminfo through...

CVE-2026-23538: Allocation of Resources Without Limits or Throttling

A vulnerability was identified in the Feast Feature Server's /ws/chat endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory, CPU...

-fides-amor-et-lux (1.0.0), -price-checker (>=1.0.0, <=1.0.5) +54300 more potentially affected by CVE-2026-62389 via ws (>=8.0.0, <=8.21.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =1.1.0, =0.1.0-rc.7, =0.1.0, =1.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-62389 Source advisory: SNYK:JS-WS-17988732...

Malware in @dervix/ws

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview @dervix/ws is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

bugbug (>=0.0.590, <=0.0.593), ws-bom-robot-app (>=0.0.86, <=0.0.92) potentially affected by CVE-2026-55443 via langchain-anthropic (0.3.19)

langchain-anthropic PYPI version 0.3.19 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-anthropic and may be impacted: - bugbug =0.0.590, =0.0.86, =0.0.92 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2556...

terminal-buddy (>=0.1.1, <=0.1.2), ws-bom-robot-app (>=0.0.86, <=0.0.88) potentially affected by CVE-2026-26013 via langchain-core (0.3.75)

langchain-core PYPI version 0.3.75 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - terminal-buddy =0.1.1, =0.0.86, =0.0.88 Source cves: CVE-2026-26013 Source advisory: OSV:PYSEC-2026-2562...

MAL-2026-10402 Malicious code in @gleamkit/ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fc9213fe9e786988b3fd882b571f03aeaa1487b8006badb837b4e804da66eee The package publishes under scope @gleamkit/ws while copying the ws package's description, homepage, repository, author, and README verbatim, and...

PDF CVE-2020-29075 Silent DNS Callback

Generate PDF PoC for CVE-2020-29075: silent DNS/HTTP via catalog /AA /WC, /WS, /DS without user prompt in Acrobat Reader. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.silent import writesilentdnscatalogaa class...

CVE-2026-54780

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference...

CVE-2026-54773

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security an...

CVE-2026-54784 CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session...