63 matches found
CVE-2026-1961-foreman-poc
Foreman WebSocket Proxy Command Injection CVE-2026-1961 — PoC Proof-of-concept for a command injection vulnerability in Foreman's WebSocket proxy lib/wsproxy.rb, disclosed responsibly to Red Hat and patched. Summary Foreman's WebSocket proxy interpolates an unsanitized host value, sourced from a...
CVE-2026-15409
🚀 CVE-2026-15409 – SonicWall SMA 1000 Erlang RCE via WebSocket Proxy Proof‑of‑Concept exploit for CVE-2026-15409 – unauthenticated remote code execution on SonicWall SMA 1000 series appliances via the Erlang distribution protocol tunneled over WebSocket. 📖 Overview CVE-2026-15409 is a critical...
grdpwasm
grdpwasm A web-based RDP client built with Go WebAssembly and grdp. Connect to a Windows Remote Desktop server directly from your browser — no plugins required. Architecture Browser WASM ──WebSocket──► proxy Go ──TCP──► RDP Server Because browsers cannot open raw TCP sockets, a lightweight Go pro...
Echo: WebSocket proxy can retain connections and handlers after client disconnect
Impact Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction...
GHSA-9969-6676-49H5 Echo: WebSocket proxy can retain connections and handlers after client disconnect
Impact Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction...
Exploit for CVE-2026-1961
Foreman WebSocket Proxy Command Injection CVE-2026-1961 — Po...
Malicious code in webpackbootstrap5 (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
Malicious code in @zaka13/thing (npm)
@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...
Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
Malicious code in @zaka13/thing (npm)
@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...
Malicious code in webpackbootstrap5 (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
MAL-2026-16200 Malicious code in @zaka13/thing (npm)
@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...
MAL-2026-16201 Malicious code in webpackbootstrap5 (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
MAL-2026-16202 Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration
A flaw was found in webpack-dev-server. When a user configures a proxy with a broad context, such as '/', and enables WebSocket ws: true forwarding, the development server's own Hot Module Replacement HMR WebSocket can be intercepted. This interception leads to the leakage of the browser's cookie...
Exploit for Server-Side Request Forgery in Sonicwall Sma6210_Firmware
🚀 CVE-2026-15409 – SonicWall SMA 1000 Erlang RCE via WebSocket...
MAL-2026-11122 Malicious code in @crbrc/xbt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 179d74e089794cb517fcb4030021310137bedcc72f0ef49362b4ce1724cb5ac3 dist/index.js contains a startControlClient routine that reads OxaPay payment-gateway secrets OXAPAYGENERALAPIKEY, OXAPAYMERCHANTAPIKEY,...
MAL-2026-10706 Malicious code in @agentvox/host (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0482819726a3b7e7f36315f58ee95e3017bc649c2ea89958776c4985fe32ab The host daemon opens an outbound WebSocket connection to a hardcoded default proxy https://proxy.agentvox.bot and, on receipt of a session.open...
Malicious code in permcarmserver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e70168ba32f543c08a0c98b81e648d09e9793bcc533a34c2f0ce9ca7a14536e On require, index.js spawns a worker that uses koffi FFI to load a file named index.html and invoke its exported vserverstart. Despite the extension,...