PT-2026-105793

Impact djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware, so on the live WebSocket/SSE path get current tenant was always None during mount and every event handler — and the tenant-awa...

CVE-2026-104057: Concurrent Execution using Shared Resource with Improper Synchronization

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

CVE-2026-104058: Missing Authentication for Critical Function

Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnection...

CVE-2026-51880

The deeptutor 1.4.0 software contains a path traversal vulnerability within the EditFileTool.execute component. A remote caller can exploit this issue via the live tutorbot WebSocket interface to induce the tool layer to write or edit absolute paths outside the intended bot workspace. This vulner...

CVE-2026-51881

The deeptutor 1.4.0 software is vulnerable to a code injection flaw within the ExecTool.execute component. An attacker can leverage the live tutorbot WebSocket interface to induce the tool layer into executing arbitrary shell commands chosen by the reviewer within the service environment. Exploit...

PT-2026-105580

SIPGO: DoS via unvalidated WebSocket frame length in github.com/emiago/sipgo...

PT-2026-105599

Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin - remote node memory/goroutine exhaustion DoS in github.com/klever-io/klever-go...

CVE-2026-51881

deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to execute reviewer-chosen shell commands in the service environment...

CVE-2026-51880

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...

PT-2026-104038

Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description A path traversal issue exists in the EditFileTool.execute function. A remote caller can use the live tutorbot WebSocket interface to force the tool layer to write or edit absolute paths outside the designate...

PT-2026-104039

Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description Code injection exists in the ExecTool.execute function. A remote caller can use the live tutorbot WebSocket interface to induce the tool layer to execute shell commands chosen by a reviewer within the servic...

PT-2026-104005

Name of the Vulnerable Software and Affected Versions monta.app affected versions not specified Description The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier, leading to predictable...

PT-2026-103967

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps activePlayers and allConnections in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote...

PT-2026-103968

Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnection...

PT-2026-104003

Name of the Vulnerable Software and Affected Versions monta.app affected versions not specified Description Charging station authentication identifiers are publicly accessible through web-based mapping platforms. Recommendations At the moment, there is no information about a newer version that...

PT-2026-104004

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description WebSocket endpoints lack proper authentication mechanisms, which allows attackers to impersonate charging stations. This flaw enables unauthorized access to...

PT-2026-104006

Name of the Vulnerable Software and Affected Versions monta.app affected versions not specified Description The WebSocket Application Programming Interface lacks rate limiting on authentication requests. This deficiency allows an attacker to perform brute-force attacks to obtain unauthorized acce...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2025:1740230558)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1740230558 advisory. - Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connection...

Rocky Linux 9 [CIQ] Security Update: mod_http2 / mod_http2-debuginfo / mod_http2-debugsource (crlsa-2024_8680)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20248680 advisory. modhttp2: DoS by null pointer in websocket over HTTP/2 CVE-2024-36387 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc (crlsa-2026_5578)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20265578 advisory. qemu-kvm: VNC WebSocket handshake use-after-free CVE-2025-11234 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...