GHSA-4HV6-XC92-J86G Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: DELETE /api/v2/user/sessions/id documents "Revokes a specific session by its UUID", and enabling TOTP calls DeleteAllUserSessions to invalidate all sessions. The WebSocket endpoint accepts any cryptographically vali...

Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes

Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: DELETE /api/v2/user/sessions/id documents "Revokes a specific session by its UUID", and enabling TOTP calls DeleteAllUserSessions to invalidate all sessions. The WebSocket endpoint accepts any cryptographically vali...

MGASA-2026-0479 Updated tomcat package fixes security vulnerabilities

OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. CVE-2026-73581 Cross-context authentication mix-up with Jakarta Authentication configured. CVE-2026-75973 Bypass of security constraints for WebSocket endpoints. CVE-2026-76183 Transfer-Encoding honored for...

Updated tomcat package fixes security vulnerabilities

OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. CVE-2026-73581 Cross-context authentication mix-up with Jakarta Authentication configured. CVE-2026-75973 Bypass of security constraints for WebSocket endpoints. CVE-2026-76183 Transfer-Encoding honored for...

CVE-2026-107807

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

CVE-2026-107807 Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

BIT-THRIFT-2026-92834 Apache Thrift: C++ WebSocket server transport does not read a full request length

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

BIT-THRIFT-2026-83745 Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...

CVE-2026-107909

A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...

CVE-2026-107909

FalkorDB versions before 4.20.0 are vulnerable to a pre-authentication heap out-of-bounds write in the ws_read_frame and buffer_apply_mask functions. This occurs because WebSocket frames with a 64-bit extended payload length are not properly bounded; the existing check is an ASSERT() that is omit...

EUVD-2026-95486

A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...

CVE-2026-107909 Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length

A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...

CLEANSTART-2026-OA48166 Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance

Security vulnerability affects the apache2 package. Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance...

CVE-2026-107807: Cleartext Storage of Sensitive Information

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...

PT-2026-109184

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...

PT-2026-109199

Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_76750)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676750 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequested...

PT-2026-108728

Name of the Vulnerable Software and Affected Versions FalkorDB versions prior to 4.20.0 Description A heap-based out-of-bounds write exists in the ws read frame function src/bolt/ws.c and the buffer apply mask function src/bolt/buffer.c. A remote unauthenticated attacker can cause a denial of...

Wireshark 1.12.x < 1.12.5 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.12.5. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.12.5 advisory. - The detectversion function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x...

PT-2026-116486

Name of the Vulnerable Software and Affected Versions Vikunja versions 2.3.0 through 2.6.x Description Improper session validation allows attackers to maintain WebSocket access even after a session has been revoked. This occurs because the handleAuth function fails to verify the sid claim of the...