CVE-2025-68930

🔍 CVE-2025-68930 分析：Traccar 中的 WebSocket 劫持漏洞 CVE-2025-68930 暴露了 Traccar （开源 GPS 跟踪系统）中的一个 关键跨站 WebSocket 劫持漏洞（CSWSH） 。以下是关键详情： 🛡️ 漏洞详情 受影响端点 ：/api/socket 根本原因 ：WebSocket 握手期间 未对Origin 标头进行验证。 利用机制 ： 1. 攻击者诱骗已认证用户访问恶意网站。 2. 恶意网站利用用户的活跃会话（JSESSIONID）与 Traccar 服务器建立 WebSocket 连接。 3. 服务器 接受连接...

Rocky Linux 10.1 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc (crlsa-2026_1831)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20261831 advisory. qemu-kvm: VNC WebSocket handshake use-after-free CVE-2025-11234 Tenable has extracted the preceding description block directly from the CIQ security advisory. No...

Rocky Linux 9 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc (crlsa-2026_18772)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202618772 advisory. qemu-kvm: VNC WebSocket handshake use-after-free CVE-2025-11234 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note...

CVE-2026-50608

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service...

EUVD-2026-81399

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service...

CVE-2026-50608 Authentication Vulnerability in NitroSense and PredatorSense Software

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service...

CVE-2026-50608

CVE-2026-50608 affects the Acer System Monitoring component shipped with NitroSense and PredatorSense software. The root cause is an improperly implemented WebSocket handshake that does not require authentication before permitting connections to the local service, potentially allowing unauthorize...

CVE-2026-50608: Missing Authentication for Critical Function

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service...

CVE-2026-18151

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process...

EUVD-2026-77765

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process...

CVE-2026-18151 IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process...

CVE-2026-18151

CVE-2026-18151 affects IBM Navigator for i and Digital Certificate Manager for i on IBM i 7.3–7.6 . The vulnerability is a race condition (CWE-362) during the WebSocket handshake process , allowing a remote authenticated attacker to obtain sensitive information. The CVSS 3.1 score is 4.2 (MEDIUM)...

CVE-2026-18151 IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process...

PT-2026-91393

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

Summary IBM Navigator for i and IBM Digital Certificate Manager DCM for i use Angular for frontend Graphical User Interfaces GUI. Angular is vulnerable to cross-site scripting XSS by permitting event-handler attributes in the i18n pipeline, allowing a lower-trust translation file to inject...

DEBIAN-CVE-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...

CVE-2026-19534 undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...

CVE-2026-82448

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82448 Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82448

Shinobi (a self-hosted CCTV/surveillance platform) contains a hardcoded connection key in its child node service prior to commit 5a76c74f . An unauthenticated attacker who can reach the child node port can present this key during the WebSocket handshake and then dispatch arbitrary SQL queries thr...