CVE-2026-47848

CVE-2026-47848 affects the Reactor Netty WebSocket client (versions 1.0.52 and earlier , 1.1.0–1.2.18 , and 1.3.0–1.3.6 ). In specific scenarios where a WebSocket handshake is redirected to a different origin , the client may leak credentials to the redirected origin. The condition requires the H...

CVE-2025-61164

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

Insufficient Session Expiration

Overview org.apache.tomcat:tomcat-websocket is a Tomcat WebSocket JSR356 implementation. Affected versions of this package are vulnerable to Insufficient Session Expiration due to the improper termination of WebSocket sessions when the associated HTTP session ends. An attacker can maintain access...

Insufficient Session Expiration

Overview org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Insufficient Session Expiration due to the improper termination of WebSocket sessions when the associated HTTP session ends. An...

Insufficient Session Expiration

Overview org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies. Affected versions of this package are vulnerable to Insufficient Session Expiration due to the improper termination of WebSocket sessions when th...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to the improper termination of WebSocket sessions when the associated HTTP session ends. An attacker can maintain access to resources beyond the intended session duration by establishing a WebSocket...

Insufficient Session Expiration

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Insufficient Session Expiration due to the improper termination of WebSocket sessions when the associated HTTP session ends. An attacker can maintain access to...

EUVD-2026-66192

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-47848: Undefined Security Weakness

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 -...

CVE-2025-61164: Exposure of Sensitive Information to an Unauthorized Actor

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

CVE-2025-61164

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

EUVD-2025-210785

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

CVE-2025-61164

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

PT-2026-82238

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

CVE-2025-61164

A flaw in Cohere North AI v1.1.5 allows for an information leak through its WebSocket Endpoint . A remote attacker could exploit this vulnerability to gain unauthorized access to sensitive data. To mitigate this risk, users should disable the affected WebSocket endpoint in the service configurati...

PT-2026-82249

Name of the Vulnerable Software and Affected Versions Reactor Netty versions 1.3.0 through 1.3.6 Reactor Netty versions 1.1.0 through 1.2.18 Reactor Netty versions 1.0.52 and earlier Description The Reactor Netty WebSocket client may leak credentials during WebSocket handshake redirects to a...

The vulnerability of the ws.c file of the WebSocket server in the Libevent library allows a attacker to induce a service failure.

The vulnerability of the ws.c file of the WebSocket server in the Libevent library-related event notification asynchronous library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Linux Distros Unpatched Vulnerability : CVE-2026-73180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket...

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

DEBIAN-CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...