11008 matches found
PT-2026-91214
LangBot's plugin runtime pip package langbot plugin through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 /plugin/ws whose authentication is gated on plugin debug key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose which...
Malicious code in @zaka13/thing (npm)
@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...
PT-2026-91292
DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions includin...
CVE-2026-18151: Concurrent Execution using Shared Resource with Improper Synchronization
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process...
PT-2026-91393
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process...
PT-2026-91439
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin...
CVE-2026-18251: Missing Origin Validation in WebSockets
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin...
Malicious code in webpackbootstrap5 (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
MAL-2026-16200 Malicious code in @zaka13/thing (npm)
@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...
Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
Malicious code in pino-ulid (npm)
The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs node dist/node/utils.js after checking the dist files exist with existsSync. dist/node/utils.js writes a PID lock file, sets up persistence on Windows...
PT-2026-91203
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service...
MAL-2026-16201 Malicious code in webpackbootstrap5 (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
Amazon Linux 2023 : libsoup, libsoup-devel (ALAS2023-2026-2160)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2160 advisory. A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper bounda...
Allocation of Resources Without Limits or Throttling
Overview org.java-websocket:Java-WebSocket is a barebones WebSocket server and client implementation written in 100% Java. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the processFrameContinuousAndNonFin function in Draft6455.java of...
CVE-2026-90584
A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be perform...
EUVD-2026-77090
A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be perform...
CVE-2026-90584 TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be perform...
CVE-2026-90584 TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be perform...
CVE-2026-90584 TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be perform...