CVE-2025-61164

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

CVE-2025-61164

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

PT-2026-82238

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

PT-2026-82249

Name of the Vulnerable Software and Affected Versions Reactor Netty versions 1.3.0 through 1.3.6 Reactor Netty versions 1.1.0 through 1.2.18 Reactor Netty versions 1.0.52 and earlier Description The Reactor Netty WebSocket client may leak credentials during WebSocket handshake redirects to a...

CVE-2026-47848: Undefined Security Weakness

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 -...

The vulnerability of the ws.c file of the WebSocket server in the Libevent library allows a attacker to induce a service failure.

The vulnerability of the ws.c file of the WebSocket server in the Libevent library-related event notification asynchronous library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Linux Distros Unpatched Vulnerability : CVE-2026-73180

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket...

DEBIAN-CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

CVE-2026-73180

Apache Tomcat is affected by an Insufficient Session Expiration vulnerability (CWE-613) where a WebSocket session remains open even after the underlying authenticated HTTP session ends, specifically if the session ID is changed. This occurs because the server fails to close the WebSocket connecti...

CVE-2026-73180

Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta...

GO-2026-6271 Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) in github.com/axllent/mailpit

Mailpit: WebSocket origin check bypass via percent-encoded path regression of CVE-2026-22689 in github.com/axllent/mailpit...

GO-2026-6286 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel in github.com/mattermost/mattermost-server

Mattermost doesn't restrict roleupdated websocket event broadcasts to members of the affected team or channel in github.com/mattermost/mattermost-server...

EUVD-2026-45030

Whistle vulnerable to path traversal...

CVE-2026-55571

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handlemount sends a "type":"navigate","to":... frame when loginrequired, permissionrequired, or a redirecting onmount hook denies a LiveView mount, but...

CVE-2026-55536

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...