CVE-2026-63495

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

CVE-2026-63495 Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments

A flaw was found in ws, an open source WebSocket client and server. A remote attacker can exploit this memory exhaustion vulnerability by sending a high volume of exceptionally small fragments and data chunks. This action forces the affected component to allocate and hold structural wrappers that...

webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration

A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...

K000163009: Next.js vulnerability CVE-2026-44578

Security Advisory Description Next.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. A...

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

Cybersecurity researchers have shed light on an updated version of ToxicPanda aka TgToxic that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android malware also features...

OESA-2026-3451 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the integer...

OESA-2026-3441 libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: The fix for CVE-2026-0716 commit 6ff7ef0, libsoup 3.6.6 placed the...

PT-2026-81891

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.43 through 7.0.109...

Fixed in Apache Tomcat 10.1.59

Note: The issues below were fixed in Apache Tomcat 10.1.58 but the release vote for the 10.1.58 release candidate did not pass. Therefore, although users must download 10.1.59 to obtain a version that includes a fix for these issues, version 10.1.58 is not included in the list of affected version...

CVE-2026-67448: Improper Handling of URL Encoding (Hex Encoding)

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the raw RequestURI for the /api/ prefix while Go's ServeMux routes using the percent-decoded URL path, and server/websockets/client.go configures...

CVE-2026-63495: Uncontrolled Resource Consumption

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

Mattermost Server 10.11.x < 10.11.22 / 11.7.x < 11.7.7 / 11.8.x < 11.8.4 Multiple Vulnerabilities (MMSA-2026-00685, MMSA-2026-00686, MMSA-2026-00687, MMSA-2026-00691)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities as referenced in the MMSA-2026-00685, MMSA-2026-00686, MMSA-2026-00687, MMSA-2026-00691 advisories. - Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect in scenarios where a WebSocket handshake is redirected to a different origin and the HTTP client is explicitly configured to follow redirects. An attacker can obtain sensitive credentials by leveraging crafted redirect...

cve-2026-47848 - MEDIUM - Reactor Netty WebSocket Client Leaks Credentials On Redirect

cve-2026-47848 - MEDIUM - Reactor Netty WebSocket Client Leaks Credentials On Redirect...

PT-2026-79205

Name of the Vulnerable Software and Affected Versions Mailpit versions 1.29.0 through 1.30.5 Description An issue exists where the origin middleware in server/server.go checks the raw RequestURI for the /api/ prefix, while Go's ServeMux routes using the percent-decoded URL path. Additionally,...

CVE-2026-53546

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing. Prior to 2.3.2 , the terminal WebSocket accepts a user-controlled hostConfig.id, and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access . When no creden...

CVE-2026-53546 Termix: Missing authorization in SSH host credential resolution exposes stored credentials

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 — Marimo Pre-Authentication RCE !CVEhttps:/...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...