315 matches found
ROOT-APP-PYPI-CVE-2026-48804 CVE-2026-48804 in rootio-python-socketio - Patched by Root
Root has patched CVE-2026-48804 in the rootio-python-socketio package for Root:PyPI. Multiple fixed versions available...
PT-2026-55434
These are all security issues fixed in the python311-python-socketio-5.16.3-1.1 package on the GA media of openSUSE Tumbleweed...
OPENSUSE-SU-2026:11171-1 python311-python-socketio-5.16.3-1.1 on GA media
These are all security issues fixed in the python311-python-socketio-5.16.3-1.1 package on the GA media of openSUSE Tumbleweed...
GHSA-5W7Q-77MV-V69F python-socketio: Binary attachment accumulation can cause denial of service
Impact The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. An attacker can submit a binary message and intentionally omit sending one or more of its...
python-socketio: Binary attachment accumulation can cause denial of service
Impact The python-socketio server stores binary EVENT and ACK messages in memory while it waits to receive their binary attachments. Once all the attachments are received, these messages are then processed. An attacker can submit a binary message and intentionally omit sending one or more of its...
Allocation of Resources Without Limits or Throttling
Overview python-socketio is a Socket.IO server and client for Python Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the process that stores binary EVENT and ACK messages in memory while awaiting their binary attachments. An attacke...
PT-2026-53019
Name of the Vulnerable Software and Affected Versions python-socketio versions prior to 5.16.2 Description The server stores binary EVENT and ACK messages in memory while awaiting their binary attachments. An attacker can trigger a memory exhaustion issue by submitting a binary message and...
Open WebUI: Any authenticated user can read other users' private notes via Socket.IO
Summary The ydoc:document:join Socket.IO handler checks note ownership only when the documentid starts with note: colon. However, the YdocManager storage layer normalizes all document IDs by replacing colons with underscores documentid.replace":", "". An attacker can join a document room using no...
PT-2026-47616
Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.2 Description FUXA is a web-based Process Visualization software. A remote unauthenticated attacker can exploit a Server-Side Request Forgery SSRF issue where the server acts as an oracle to read data from internal o...
The vulnerability of the python-socketio library, related to deserialization mechanism flaws, allows attackers to execute arbitrary code.
The vulnerability of the python-socketio library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
ROS-20260216-73-0004
Vulnerability in python-socketio related to a flaw in the deserialization mechanism. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...
CVE-2020-24928
managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server port 3020 open to all origins, which allows attackers to obtain sensitive Discord user information...
PT-2026-48587
Name of the Vulnerable Software and Affected Versions Qualcomm QSC family affected versions not specified Description Improper authorization in the firmware of the Qualcomm QSC integrated circuit family allows a remote attacker to achieve Remote Code Execution RCE, which is the ability to execute...
Malicious code in cassini-socketio-concurrently-forever (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e912fdb2bf197c65c430a9c9fbd0f8051136d3e5aec231088a303a0882b680f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in fornax-socketio-ganymede-boson (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbf81223eb44037f720c7f81236de5d3bf785a23ec6a4b48c754958e420b7afc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in socketio-chalk-middleware-public (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5456f60ff4b15c35d27afbffb27cbe1a99bfed860e26c0f7ecd263251301e09b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in typeorm-csv-troposphere-socketio (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e73547aa88679589280af7f97832cc643441c415a7b0c69aa00448db76023b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in vuepress-parallax-socketio-juno (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58bc0674a620983ea2af74aa10753189e4138f07b84db82b35cc3e0fc56b5611 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
