EUVD-2026-84259

A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-94493 Gigatech PDV5701 WebSocket Service index.html missing authentication

A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-94493

A missing authentication vulnerability in the WebSocket Service component of Gigatech PDV5701 version 1.0.31_240305_112640 affects the file /index.html. The flaw allows a remote attacker with no privileges to exploit the service, rated CVSS 4.0: 10.0 (Critical) with high impact across confidentia...

CVE-2026-83599: Improper Handling of Highly Compressed Data (Data Amplification)

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocketclientdecompressmessage to grow decompressed output toward...

CVE-2026-94493: Missing Authentication for Critical Function

A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...

PT-2026-96329

Name of the Vulnerable Software and Affected Versions Gigatech PDV5701 version 1.0.31 240305 112640 Description An issue exists in the WebSocket Service component where improper processing of the /index.html endpoint allows remote attackers to bypass authentication. Recommendations At the moment,...

PT-2026-96845

Name of the Vulnerable Software and Affected Versions Netdata versions prior to 2.11.0 Description The unauthenticated WebSocket server negotiates permessage-deflate before authentication. In the file src/web/websocket/websocket-compression.c, the function websocket client decompress message allo...

PT-2026-96709

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.14.0 through 0.16.1 Description Improper validation of the specified quantity in the input allows a client with an open payment channel to obtain paid resources without being charged. The function accept voucher/3 in...

PT-2026-96790

Name of the Vulnerable Software and Affected Versions Frigate versions prior to 0.17.2 Description The WebSocket handler in frigate/comms/ws.py forwards message topics to the dispatcher without verifying the authenticated user's role. This occurs because the nginx authentication subrequest lacks...

RHEL 8 : libsoup (RHSA-2026:69863)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69863 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: SoupWebsocketExtensionDeflate: libsoup: libsoup:...

CVE-2026-75607: Missing Authorization

Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to the dispatcher without checking the authenticated user's role because the nginx authentication subrequest does not provide role-aware...

CVE-2026-63330

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-62247

Supabase Realtime (prior to 2.111.2 ) contains an incorrect authorization flaw in its per-extension presence.read row-level security (RLS) policy enforcement. When a private-channel client is granted presence.write but explicitly denied presence.read , the client can still receive presence_diff m...

CVE-2026-63330 Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-63330 Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-63330

Warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux, is affected by a missing authorization check prior to version 0.25.6 . The api_get_recording_stream function in warpgate-admin/src/api/recordings_detail.rs protects the recording stream WebSocket endpoint with only session aut...

EUVD-2026-84061

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-63330 Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, apigetrecordingstream in warpgate-admin/src/api/recordingsdetail.rs protects /@warpgate/admin/api/recordings/uuid/stream only with session authentication and omits requireadminpermission for...

CVE-2026-63329 Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

MAL-2026-16355 Malicious code in gemini-computer-use (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56b34e8766d76b6b5c93094a8c8288f85fbb505fef68634a7bdf395abaebb329 The package's bin/cli.js — declared as both main and bin in package.json — unconditionally runs curl -fsSL...