Astra Linux – Vulnerability in Qemu

A flaw was discovered in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can result in the callback being fired later, thereby causing a use-after-free when using the channel. This vulnerability can be exploited by a malicious...

Astra Linux – Vulnerability in ruby-websocket-extensions

The websocket-extensions Ruby module before version 0.1.5 allowed Denial of Service DoS attacks through Regex backtracking. The extension parser could take quadratic time when parsing a header containing an unclosed string parameter value whose content was a repeated two-byte sequence of a...

MAL-2026-13398 Malicious code in @xiaohhhh1/canvas-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119 On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/agent-relay and treats inboun...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 13.0.1 Vulnerability Details CVEID:CVE-2025-12183 DESCRIPTION: Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untruste...

CVE-2026-17613

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...

Apache Tomcat 10.1.24 < 10.1.58

The version of Tomcat installed on the remote host is prior to 10.1.58. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat10.1.58security-10 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affect...

GHSA-G5VV-Q72C-7J78 @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

Summary @anephenix/hub starts a setInterval polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies — which requires no authentication or special configuration — the interval and the pending request object are never cleaned up, even...

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache...

Missing Authentication for Critical Function

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authentication for Critical Function via unauthenticated access to the ydoc:awareness:update and ydoc:document:leave event handlers. An attacker can disrupt collaborative editing sessions, impersonate...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.

A flaw was found in Apache Tomcat. During WebSocket authentication, the HTTP Authentication Header can be exposed to unexpected hosts. This vulnerability leads to information disclosure, potentially allowing an attacker to gain access to sensitive authentication credentials...

GHSA-9MQV-5HH9-4CGG Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...

MAL-2026-10705 Malicious code in @agent-link/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7018626958a160ab35a17b31ddd130ba9b6046b870f115b0fa83622b66bd912 The package's runtime connects to a hardcoded WebSocket relay default wss://msclaude.ai and dispatches messages received from that relay directly int...

Malicious code in @agent-link/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7018626958a160ab35a17b31ddd130ba9b6046b870f115b0fa83622b66bd912 The package's runtime connects to a hardcoded WebSocket relay default wss://msclaude.ai and dispatches messages received from that relay directly int...

MAL-2026-10735 Malicious code in isite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f0ac64df493f0f780dab52b41f561daedaf70c2a6c9cb62fe51307f89d29fe On initialization of the framework index.js - init, lib/wsClient.js opens a WebSocket to ws://socket.social-browser.com/isite URL hidden by a custom...

ALSA-2026:39868 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

EUVD-2026-44408

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

CVE-2026-15711

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames e.g., PING, PONG, CLOSE contain a payload of 125 bytes or less. A remote, unauthenticated attacker...

CVE-2026-62197 OpenClaw < 2026.6.6 Policy Bypass via CDP Discovery

OpenClaw before 2026.6.6 contains a policy bypass vulnerability in browser CDP discovery that accepts blocked WebSocket URLs. Attackers with lower-trust access can reach network destinations that should have been blocked by OpenClaw policy when the affected feature is enabled...

MAL-2026-10489 Malicious code in permcserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fcdfd2e40ddb8c0aef4fa0fb93f2d0bcf3b0c00104057076f8013a70812d6 The package's main index.js is a 10-line FFI shim that spawns a worker, dlopens the bundled lib-linux.so via koffi, and immediately invokes the nativ...