CVE-2026-1731

CVE-2026-1731 BeyondTrust Remote Support Pre-Auth RCE PoC !WARNING This script is intended for educational and research purposes only. Do not use it against systems without explicit permission. Unauthorized access or testing is illegal and unethical. Read the full DISCLAIMER before using this...

EUVD-2026-85225

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following version...

EUVD-2026-85151

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

CVE-2026-39987

CVE-2026-39987 For Marimo 0.20.4 PoC ⚠️ This tool is intended for educational purposes and authorized security testing only. The creator is not responsible for any unauthorized or illegal use. Use at your own risk. ⚠️ Info: CVE-2026-39987 is a critical pre-authentication Remote Code Execution RCE...

CVE-2026-39987-PoC

CVE-2026-39987 PoC Summary Marimo = 0.20.4 is affected by a pre-authentication RCE vulnerability in the /terminal/ws WebSocket endpoint. The endpoint checks the application mode and terminal support, but does not validate authentication before accepting the WebSocket connection. It then creates a...

CVE-2020-13935

Exploit para la vulnerabilidad WebSocket en Apache Tomcat CVE-2020-13935 En el artículo de blog correspondiente se explican en detalle el análisis y la explotación de la vulnerabilidad. Uso Clona el repositorio y, a continuación, compila el binario tcdos. Ejecuta el programa de la siguiente maner...

dnspython

dnspython INTRODUCTION dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG-authenticated messages and EDNS0. dnspython provides both high- and low-level access to DNS. The high-level classes...

CVE-2026-39987

POC del Exploit CVE-2026-39987 Descripción general Este repositorio contiene un script de Prueba de Concepto POC para CVE-2026-39987, una vulnerabilidad de Ejecución Remota de Código RCE previa a la autenticación en Marimo. El exploit aprovecha un endpoint WebSocket para ejecutar comandos...

CVE-2024-12356

Unauthenticated Remote Code Execution in BeyondTrust Remote Support and Privileged Remote Access via Argument Injection and a PostgreSQL String-Escape Bypass Ethical Warning: Research, educational, and authorized testing purposes only. Please do not use against systems without permission...

CVE-2026-39987_POC

PoC — CVE-2026-39987 · Marimo Pre-Auth RCE CVSS 4.0: 9.3 Critical · AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H Affects: marimo 2 calls to...

CVE-2026-5173

🦊 CVE-2026-5173: PoC de Ejecución No Autorizada de Métodos en GitLab WebSocket 🛠️ Resumen CVE-2026-5173 permite a un atacante autenticado con bajos privilegios invocar métodos backend restringidos a través del endpoint WebSocket /-/cable de GitLab, específicamente mediante GraphqlChannel. Esto...

CVE-2026-39987

CVE-2026-39987 - Marimo Pre-Authentication RCE CVE-2026-39987 is a critical pre-authentication Remote Code Execution RCE vulnerability affecting Marimo, a reactive Python notebook environment. The vulnerability exists in Marimo's terminal WebSocket endpoint: root@kitploit: /terminal/ws The endpoi...

CVE-2026-42228

GHSA-f77h-j2v7-g6mw — n8n Unauthenticated Chat Execution Hijacking CVE: CVE-2026-42228 Severity: High Affected: n8n 1.123.32 Fixed in: n8n 1.123.32 / 2.17.4 / 2.18.1 Vulnerability Summary chat-service.ts :: startSession accepts an executionId from the WebSocket query string and only checks that t...

CVE-2026-39987

⚠️ CVE-2026-39987 — Unauthenticated Shell in marimo 0.23.0 A reactive Python notebook tool gave attackers a full shell in one WebSocket request. 📌 Overview CVE-2026-39987 is a critical pre-auth RCE vulnerability in marimo — a popular open-source reactive notebook for Python modern Jupyter...

CVE-2026-39987-Lab

CVE-2026-39987 — marimo Pre-Auth Terminal WebSocket RCE Lab Local-only Docker lab for reproducing and understanding CVE-2026-39987 in marimo. This project compares a vulnerable marimo service with a patched marimo service side-by-side, then demonstrates the difference using a least-harm proof...

CVE-2026-90946

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repourl as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including...

CVE-2026-90946 DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repourl as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including...

EUVD-2026-77713

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repourl as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including...

CVE-2026-90919

LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visualregister WebSocket endpoint that passes the first client frame directly to pickle.loads. Attackers can reach the Config Server port and send a malicious serialized payload with a...