CVE-2026-54722

DSSRF (Node.js library) has a vulnerability in is_url_safe prior to version 1.0.4. The bug arises because is_url_safe strips the @ userinfo delimiter via remove_at_symbol_in_string before parsing URLs, allowing an attacker-controlled URL to bypass internal-IP validation and cause a client using t...

CVE-2025-55300 Komari Allows Cross-site WebSocket Hijacking

Komari is a lightweight, self-hosted server monitoring tool designed to provide a simple and efficient solution for monitoring server performance. Prior to 1.0.4-fix1, WebSocket upgrader has disabled origin checking, enabling Cross-Site WebSocket Hijacking CSWSH attacks against authenticated user...

CVE-2025-55300

CVE-2025-55300 affects the GitHub project github.com/komari-monitor/komari (Komari) and is caused by the WebSocket upgrader disabling origin checking, which enables Cross-Site WebSocket Hijacking (CSWSH) against authenticated users. An attacker can craft requests to the terminal WebSocket endpoin...