WS-2017-0126

Affected versions of the package are vulnerable to Protection Bypass via ng-attr-action and ng-attr-srcdoc...

WS-2016-0045

Versions 1.3.3 and below contain a cross site scripting vulnerability in the drag and drop functionality for modifying tree data. A node that contains a standard XSS vector will have its payload execute when a user attempts to drag a node to a different position in the hierarchy...

WS-2017-0116

The use element can reference external svg's same origin and can include xlink javascript urls or foreign object that can execute xss...

NPM: ws: Uninitialized memory disclosure

NPM: ws: Uninitialized memory disclosure vulnerability discovered by ? in WordPress Npm ws versions = 8.0.0, 8.20.1...

-fides-amor-et-lux (1.0.0), -price-checker (>=1.0.0, <=1.0.5) +33753 more potentially affected by CVE-2026-45736 via ws (>=8.0.0, <=8.20.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit 0.1.0 - 0g-zksettlement-client 1.0.0 and more Source cves: CVE-2026-45736 Source advisory: OSV:GHSA-58QX-3VCG-4XPX...

GHSA-58QX-3VCG-4XPX ws: Uninitialized memory disclosure

Impact The websocket.close implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. Proof of concept js import deepStrictEqual from 'node:assert'; import WebSocket, WebSocketServer from 'ws'; const wss = new WebSocketServer port: 0,...

-fides-amor-et-lux (1.0.0), -price-checker (>=1.0.0, <=1.0.5) +33753 more potentially affected by CVE-2026-45736 via ws (>=8.0.0, <=8.20.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit 0.1.0 - 0g-zksettlement-client 1.0.0 and more Source cves: CVE-2026-45736 Source advisory: GHSA-58QX-3VCG-4XPX...

Linux Distros Unpatched Vulnerability : CVE-2026-45736

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close implementation is vulnerable to uninitialized memory disclosu...

-fides-amor-et-lux (1.0.0), -price-checker (>=1.0.0, <=1.0.5) +33753 more potentially affected by CVE-2026-45736 via ws (>=8.0.0, <=8.20.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit 0.1.0 - 0g-zksettlement-client 1.0.0 and more Source cves: CVE-2026-45736 Source advisory: MEND:CVE-2026-45736...

CVE-2026-45736

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1...

CVE-2026-45736: Use of Uninitialized Resource

ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1...

WS-2017-3768

Information Exposure vulnerability due to logging all of the bytes uploaded when the logger is set to the INFO level, a possible confidential information in those bytes...

WS-2019-0152

apostrophe before 0.92.0 vulnerable to Open Redirect when redirecting requests to third-party websites if escaped URLs followed by a trailing...

WS-2017-0258

Navigating to a page with dagid param specified as a html tag leads to that tag being rendered due to using Markup tag which makes html be labeled as safe. XSS issues with unsanitized user input being displayed...

WS-2017-0230

Affected versions of the package do not remove clientsecret from the URI generated by getAuthUri...

WS-2016-0136

Currently file metadata of locked files is visible for users with "read" permission. file data is not shown / not downloadable...

WS-2017-0235

Affected versions of the package expose absolute paths for plugin includes...

WS-2015-0041

Affected versions of this package are vulnerable to Information Exposure due to storing the password with the interactive method...

CVE-2026-42402

A flaw was found in Apache Neethi. A remote attacker can exploit this vulnerability by providing specially crafted WS-Policy documents. This triggers an algorithmic complexity issue during policy normalization, leading to an exponential expansion of policy alternatives. This unbounded memory...

CVE-2026-42403

A flaw was found in Apache Neethi. An attacker can exploit this vulnerability by crafting malicious WS-Policy documents that contain circular policy references. This can cause the policy normalization process to enter an infinite loop or excessive recursion, leading to a stack overflow or...