PT-2026-104004

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description WebSocket endpoints lack proper authentication mechanisms, which allows attackers to impersonate charging stations. This flaw enables unauthorized access to...

PT-2026-105206

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.59, from 9.0.0 through 9.0.121. The following versions were EO...

PT-2026-105212

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.5...

PT-2026-105795

Impact The djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling import module path, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before an...

Rocky Linux 10.0 [CIQ] Security Update: libsoup3 / libsoup3-debuginfo / libsoup3-debugsource / etc Multiple Vulnerabilities (crlsa-2025_8128)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258128 advisory. libsoup: Denial of Service attack to websocket server CVE-2025-32049 libsoup: Denial of service in server when client requests a large amount of...

Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc (crlsa-2026_5578)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20265578 advisory. qemu-kvm: VNC WebSocket handshake use-after-free CVE-2025-11234 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2025:1740230558)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1740230558 advisory. - Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connection...

AlmaLinux 9.2 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc (ALMALINUX9.2:CLSA-2025:1746654460)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746654460 advisory. - GNOME libsoup before 3.6.1 has an infinite loop, and memory consumption. during the reading of certain patterns of WebSocket data from...

Rocky Linux 9 [CIQ] Security Update: mod_http2 / mod_http2-debuginfo / mod_http2-debugsource (crlsa-2024_8680)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20248680 advisory. modhttp2: DoS by null pointer in websocket over HTTP/2 CVE-2024-36387 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2024_3666)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243666 advisory. Apache Tomcat: HTTP/2 header handling DoS CVE-2024-24549 Apache Tomcat: WebSocket DoS with incomplete closing handshake CVE-2024-23672 Bug Fixes: Rebase...

PT-2026-105803

Impact The WebSocket handle mount and ViewRuntime. build request rebuild an HttpRequest via RequestFactory.get... with no HTTP HOST, so request.get host defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the...

PT-2026-103968

Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnection...

PT-2026-104006

Name of the Vulnerable Software and Affected Versions monta.app affected versions not specified Description The WebSocket Application Programming Interface lacks rate limiting on authentication requests. This deficiency allows an attacker to perform brute-force attacks to obtain unauthorized acce...

PT-2026-105804

Impact The live WebSocket transport authorizes a mount via check view auth, not Django's View.dispatch chain. As a result, standard Django authorization — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @method decoratorlogin required, name="dispatch", and custom dispatch guards...

CVE-2026-51881

The deeptutor 1.4.0 software is vulnerable to a code injection flaw within the ExecTool.execute component. An attacker can leverage the live tutorbot WebSocket interface to induce the tool layer into executing arbitrary shell commands chosen by the reviewer within the service environment. Exploit...

CVE-2026-51880

The deeptutor 1.4.0 software contains a path traversal vulnerability within the EditFileTool.execute component. A remote caller can exploit this issue via the live tutorbot WebSocket interface to induce the tool layer to write or edit absolute paths outside the intended bot workspace. This vulner...

CVE-2026-51880

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...

PT-2026-104038

Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description A path traversal issue exists in the EditFileTool.execute function. A remote caller can use the live tutorbot WebSocket interface to force the tool layer to write or edit absolute paths outside the designate...

CVE-2026-51880

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...

CVE-2026-51880: Improper Limitation of a Pathname to a Restricted Directory

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...