PT-2026-71709

Name of the Vulnerable Software and Affected Versions Hub versions prior to 0.2.16 Description Unauthenticated WebSocket connections trigger the loadDefaultConnectionEventListeners function to call requestClientId, which subsequently executes rpc.send for the get-client-id action and adds a reque...

PT-2026-64373

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversize message?/2 called from handle frame/3 in...

Vaultwarden -- multiple vulnerabilities

The Vaultwarden project reports: SSRF via the icon endpoint GHSA-hw4g-2v3f-74x5 GHSA-vh5m-fc9v-m84g Medium, 5.8 / 6.3 Cross-Organization Cipher Access GHSA-xwf8-pjh7-h589 Medium, 5.9 Organization Policy Bypass on Directory Import GHSA-88qc-6ch9-mc3j Medium, 5.5 Send Access-Count Bypass...

Apache Camel WebSocket Component Disclosure

The vulnerability of the sendEventNotification and getQueryMap functions in the WebsocketConsumer class of the camel-atmosphere-websocket component of the Apache Camel framework is related to insufficient validation of input data during the processing of WebSocket request parameters. Exploiting...

SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3208-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3208-1 advisory. - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. -...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption bsc1268543...

SUSE-SU-2026:3208-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. - CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service bsc1261320. CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service...

SUSE-SU-2026:3207-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues - CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service bsc1261320. - CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of...

PYSEC-2026-3483 MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Summary In affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocketserver accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

SummaryIn affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocketserver accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...

jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the alloworiginpat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This allow...

PYSEC-2026-3472 jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the alloworiginpat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This allow...

EUVD-2026-47864

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocketonprotocolerror in the library lib/facil/http/parsers/websocketparser.h of the component WebSocket Frame Parser. This manipulation of the argument onmessage causes improper input validation. The attack can ...

CVE-2026-16632

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocketonprotocolerror in the library lib/facil/http/parsers/websocketparser.h of the component WebSocket Frame Parser. This manipulation of the argument onmessage causes improper input validation. The attack can ...

PT-2026-64093

Summary In affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocket server accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...

CVE-2026-16632: Improper Input Validation

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocketonprotocolerror in the library lib/facil/http/parsers/websocketparser.h of the component WebSocket Frame Parser. This manipulation of the argument onmessage causes improper input validation. The attack can ...

PT-2026-64083

A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the allow origin pat configuration is used. The issue arises from the use of re.match for validating the Origin header, which only anchors at the start of the string. This...

CVE-2026-16632 boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocketonprotocolerror in the library lib/facil/http/parsers/websocketparser.h of the component WebSocket Frame Parser. This manipulation of the argument onmessage causes improper input validation. The attack can ...

CVE-2026-16632

CVE-2026-16632 affects boazsegev facil.io up to 0.7.4, specifically the WebSocket Frame Parser component. The vulnerability is in websocket_on_protocol_error (library file lib/facil/http/parsers/websocket_parser.h) where manipulation of the on_message argument leads to improper input validation. ...