EUVD-2026-102564

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-111383 Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-111383

The Nezha monitoring tool (versions 2.0.13 before 2.3.15 ) is vulnerable to a resource exhaustion flaw. Authenticated users can exploit the /api/v1/ws/transfer WebSocket endpoint to open unbounded concurrent connections. Specifically, the ServerTransferClass.Subscribe function allows the creation...

PT-2026-124518

TuxCare rebuilt @vitest/ws-client to address 2 CVEs. Fixed in 3.2.4-tuxcare.2...

PT-2026-124450

TuxCare rebuilt @nestjs/platform-ws to address 2 CVEs. Fixed in 11.2.3-tuxcare.1...

PT-2026-124449

TuxCare rebuilt @nestjs/platform-ws to address 2 CVEs. Fixed in 11.2.2-tuxcare.1...

PT-2026-124520

TuxCare rebuilt @vitest/ws-client to address 1 CVE. Fixed in 3.2.4-tuxcare.4...

CVE-2026-111617: Missing Authentication for Critical Function

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id ...

CVE-2026-111383: Allocation of Resources Without Limits or Throttling

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

PT-2026-124587

TuxCare rebuilt web3-providers-ws to address 1 CVE. Fixed in 1.10.4-tuxcare.1...

PT-2026-116016

WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id ...

PT-2026-124448

TuxCare rebuilt @nestjs/platform-ws to address 1 CVE. Fixed in 10.4.22-tuxcare.3...

PT-2026-125007

TuxCare rebuilt ws to address 3 CVEs. Fixed in 7.4.3-tuxcare.1...

PT-2026-125000

TuxCare rebuilt ws to address 2 CVEs. Fixed in 2.3.1-tuxcare.1...

PT-2026-125002

TuxCare rebuilt ws to address 1 CVE. Fixed in 7.5.10-tuxcare.1...

PT-2026-124519

TuxCare rebuilt @vitest/ws-client to address 1 CVE. Fixed in 3.2.4-tuxcare.3...

PT-2026-115389

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

PT-2026-124447

TuxCare rebuilt @nestjs/platform-ws to address 2 CVEs. Fixed in 10.4.22-tuxcare.1...

Nezhahq Nezha resource management error vulnerability

In versions from 1.0.0 to 2.3.15, there was a resource management error vulnerability in the dashboard file manager. This vulnerability stemmed from the fact that the fmStream in the WebSocket endpoint of the file manager did not call SetReadLimit. As a result, the message size became unlimited,...

MGdaasLab WHartTest Authorization Issue Vulnerability

MGdaasLab WHartTest 2.8.1 and earlier versions have an authorization issue vulnerability. This vulnerability stems from a lack of authentication; unverified attackers can connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints. This may lead to intercepting the test case payloads of...