CVE-2026-62963

CVE-2026-62963 affects Centrifugo prior to 6.8.4. The unidirectional WebSocket transport with uni_websocket.compression enabled did not cap output after decompression in ReadMessage (internal/websocket/conn.go advanceFrame), allowing unauthenticated requests to /connection/uni_websocket to trigge...

MAL-2026-10708 Malicious code in @aicommander/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a0d4917f10db91a59e47821bfa2399801219a85da0a59b8596d85fd3931fc93 @aicommander/agent installs a remote-machine agent that opens an outbound WebSocket to the hardcoded relay https://aicommander.dev and executes shell...

Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13a01c1162adb93d3960d9e1b1b67095dcf0a1ea72aefa6d471d0abbbabb5d9a The package installs a whalent CLI daemon that opens a persistent WebSocket connection wss:// to a Whalent Memory gateway and, per its own README,...

MAL-2026-10721 Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13a01c1162adb93d3960d9e1b1b67095dcf0a1ea72aefa6d471d0abbbabb5d9a The package installs a whalent CLI daemon that opens a persistent WebSocket connection wss:// to a Whalent Memory gateway and, per its own README,...

MAL-2026-10706 Malicious code in @agentvox/host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0482819726a3b7e7f36315f58ee95e3017bc649c2ea89958776c4985fe32ab The host daemon opens an outbound WebSocket connection to a hardcoded default proxy https://proxy.agentvox.bot and, on receipt of a session.open...

Malicious code in @yeaft/webchat-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b627f9a4ff0aaacfcd612224f76fe679e9d0a04578519d75516136e7496aad43 The package installs itself as a user-level service systemd on Linux via service/linux.js, with launchd/PM2 siblings and, at agent startup, opens a...

MAL-2026-10725 Malicious code in agentto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cd82c93e5f7bc0005dec9fbf18f01ec45bb6e6d2fb97bad2479c0209a7414bf [email protected] opens a WebSocket to the hardcoded server wss://link.agentto.net and routes terminal. RPC frames received from that server into a...

MAL-2026-10746 Malicious code in sakuraai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e When the daemon is started e.g. via sakura daemon start, the package binds an HTTP+WebSocket server on 0.0.0.0 and additionally exposes it via a...

MAL-2026-10756 Malicious code in darkglitch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a The package installs a listener CLI darkglitch -l -b that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the...

MAL-2026-10722 Malicious code in @whalent/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8865ae7d25a498766280337f12ceea445a92bd6a6565e668651a79dbcc152e9 The package's main/bin entry dist/index.cjs implements a remote agent that opens a WebSocket to a gateway configured via WHALENTGATEWAY / WHALENTTOKE...

Malicious code in @whalent/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8865ae7d25a498766280337f12ceea445a92bd6a6565e668651a79dbcc152e9 The package's main/bin entry dist/index.cjs implements a remote agent that opens a WebSocket to a gateway configured via WHALENTGATEWAY / WHALENTTOKE...

MAL-2026-10759 Malicious code in ryry-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a305ba94c92b6ec62aaf627fc1213d9e37e1645f37fd033f61c7becaba71edd ryry-cli runs as a long-lived agent that connects to a hardcoded WebSocket at wss://api.dalipen.com/aigc/task/connect and executes Python scripts und...

MAL-2026-10720 Malicious code in @vibelet/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3dc6503f9f63413994c6d0b2e19f22ebcf17f5e7ba9f713ce26ecf69c92c6c The @vibelet/cli package ships a daemon bundle dist/index.cjs, invoked by the vibelet bin and by vibelet start/restart/reset that starts an...

Malicious code in vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ea182e48a895e218d345ca6308727223e54eb285d9af44a167b6b115ba1a907 When the user runs vanexa-agent start, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay at...

MAL-2026-10751 Malicious code in vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ea182e48a895e218d345ca6308727223e54eb285d9af44a167b6b115ba1a907 When the user runs vanexa-agent start, the daemon opens a persistent WebSocket to a hardcoded Cloudflare Workers relay at...

CVE-2026-54568 Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICEINFOREQUEST with another device's targetid and receive that device's server-side systeminfo through...

CVE-2026-54568

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICEINFOREQUEST with another device's targetid and receive that device's server-side systeminfo through...

CVE-2026-54568 Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info

Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket server as a DEVICE could call DEVICEINFOREQUEST with another device's targetid and receive that device's server-side systeminfo through...

CVE-2026-23538

A vulnerability was identified in the Feast Feature Server's /ws/chat endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory, CPU...

CVE-2026-23538

The CVE affects Feast: Feast Feature Server /ws/chat accepts unauthenticated, persistent WebSocket connections. An attacker can open many concurrent connections to exhaust memory, CPU, and file descriptors, causing DoS. Affected software: Feast (Python SDK context cited by SNYK for Feast >=0.1...