CVE-2026-112101: Origin Validation Error

A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation erro...

libsoup security update

2.62.3-19 - CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly 2.62.3-18 - CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth 2.62.3-17 - CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong...

CVE-2026-111058: Missing Authorization

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

Important: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion CVE-2026-102556 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly CVE-2026-102557 libsoup: libsoup:...

PT-2026-117396

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media dirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...

ALSA-2026:84586 Important: libsoup security update

The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion CVE-2026-102556 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly CVE-2026-102557 libsoup: libsoup:...

RHEL 10 : nodejs22 (RHSA-2026:84703)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84703 advisory. Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an...

MiracleLinux 9 : nodejs:22 (AXSA:2026-2084:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2084:01 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequest...

RHEL 9 : nodejs:22 (RHSA-2026:84589)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84589 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

Oracle Linux 8 : libsoup (ELSA-2026-84586)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-84586 advisory. - CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly - CVE-2026-102558 libsoup: libsoup: Heap buffer overflow...

Ubuntu 26.04 LTS : curl vulnerabilities (USN-8927-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8927-1 advisory. It was discovered that curl, when built with GnuTLS support, had an out-of-bounds read in the WebSocket send path. An attacker could possibly use this...

AlmaLinux 8 : libsoup (ALSA-2026:84586)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84586 advisory. libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion CVE-2026-102556 libsoup: libsoup: Heap buffer overflow during WebSocket...

RHEL 8 : libsoup (RHSA-2026:84586)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84586 advisory. The libsoup packages provide an HTTP client and server library for GNOME. Security Fixes: libsoup: libsoup: Heap buffer overflow from...

Mopidy path traversal vulnerability

Mopidy versions prior to 4.0.5 have a path traversal vulnerability. This vulnerability stems from the lack of inclusion checks in the FileLibraryProvider.lookup function. As a result, unauthenticated attackers can use JSON-RPC or WebSocket to call core.library.lookup or core.tracklist.add, thereb...

openmeetings-kms-unauth

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-kms-unauth openmeetings-kms-unauth Class: Unauth KMS Reach: Remote Apache OpenMeetings 9.1.0 9773c59e - Apache Software Foundation OpenMeetings Java defaults kurento.ws.url to loopback. Official...

CVE-2026-111917

Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections t...

CVE-2026-111917

Vikunja versions 2.3.0 before 2.7.0 are vulnerable to an improper session validation flaw. The handleAuth function fails to verify the JWT sid claim against the sessions table, allowing attackers with a stolen access token to maintain active WebSocket connections at /api/v2/ws even after the sess...

CVE-2026-111917 Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation

Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections t...

CVE-2026-111917

Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections t...

CVE-2026-111917 Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation

Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections t...