29 matches found
CVE-2026-105927
The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are written after the maximum number of redeliveries is exceeded. Whe...
EUVD-2026-107426
The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are written after the maximum number of redeliveries is exceeded. Whe...
CVE-2026-105927 Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are written after the maximum number of redeliveries is exceeded. Whe...
CVE-2026-105927
The Apache Pulsar WebSocket service (versions 2.3.0 before 4.0.14 and 4.1.0 before 4.2.5) contains an improper authorization vulnerability. An authenticated user with CONSUME permissions on a subscribed topic can exploit the deadLetterTopic query parameter to inject messages into arbitrary topics...
CVE-2026-105927
The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are written after the maximum number of redeliveries is exceeded. Whe...
CVE-2026-105927 Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are written after the maximum number of redeliveries is exceeded. Whe...
Apache Pulsar authorization issue vulnerability
Versions 2.3.0 through 4.0.14 and 4.1.0 through 4.2.5 of Apache Pulsar contain an authorization issue vulnerability. This vulnerability arises because when configuring dead-letter policies via query parameters in the WebSocket service, it only checks whether the connected user has CONSUME...
PT-2026-120725
The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are written after the maximum number of redeliveries is exceeded. Whe...
CVE-2026-94493
A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...
CVE-2026-94493 Gigatech PDV5701 WebSocket Service index.html missing authentication
A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...
CVE-2026-94493 Gigatech PDV5701 WebSocket Service index.html missing authentication
A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...
EUVD-2026-84259
A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...
CVE-2026-94493
A missing authentication vulnerability in the WebSocket Service component of Gigatech PDV5701 version 1.0.31_240305_112640 affects the file /index.html. The flaw allows a remote attacker with no privileges to exploit the service, rated CVSS 4.0: 10.0 (Critical) with high impact across confidentia...
PT-2026-96329
Name of the Vulnerable Software and Affected Versions Gigatech PDV5701 version 1.0.31 240305 112640 Description An issue exists in the WebSocket Service component where improper processing of the /index.html endpoint allows remote attackers to bypass authentication. Recommendations At the moment,...
CVE-2026-94493: Missing Authentication for Critical Function
A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...
CVE-2026-50607 WebSocket Exposure Vulnerability in NitroSense and PredatorSense Software
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access...
EUVD-2026-81398
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access...
PT-2026-94190
Name of the Vulnerable Software and Affected Versions NitroSense affected versions not specified PredatorSense affected versions not specified Description The Acer System Monitoring component, used in NitroSense and PredatorSense, contains a flaw where a WebSocket service is configured to listen ...
CVE-2026-50607: Exposure of Resource to Wrong Sphere
A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access...
PT-2026-71705
Name of the Vulnerable Software and Affected Versions CyberPanel versions prior to 3.0.0 Description The WebTerminal FastAPI SSH service contains a hard-coded JSON Web Token JWT secret. This allows unauthenticated remote attackers to forge valid authentication tokens by signing them with the...