CVE-2026-90584

TooTallNate Java-WebSocket versions up to 1.6.1 are affected by a resource allocation flaw in the Fragmentation Handler , specifically the processFrameContinuousAndNonFin function in Draft_6455.java. A remote attacker with no authentication can trigger the weakness, resulting in low availability ...

Exploit for CVE-2026-24332

CVE-2026-24332 – Discord Invisible Mode Presence Leak Summ...

CVE-2026-90668

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90668

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90668

UnrealIRCd versions 6.0.5 through 6.2.6 contain a denial-of-service vulnerability in its webserver component. The server does not limit the number of HTTP request headers, allowing a remote unauthenticated attacker to send a single HTTP request with an unlimited number of headers, causing excessi...

EUVD-2026-76937

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

CVE-2026-90668: Allocation of Resources Without Limits or Throttling

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service memory consumption and unresponsive server via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC...

PT-2026-90782

Name of the Vulnerable Software and Affected Versions UnrealIRCd versions 6.0.5 through 6.2.6 Description The webserver fails to limit the number of HTTP request headers. This allows remote attackers to cause a denial of service, resulting in excessive memory consumption and an unresponsive serve...

PT-2026-90968

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft 6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be...

CVE-2026-90584: Allocation of Resources Without Limits or Throttling

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be perform...

openSUSE 16: tomcat / tomcat-admin-webapps / tomcat-el-3_0-api / tomcat-embed / etc (openSUSE-SU-2026:21823-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21823-1 advisory. - CVE-2026-65182: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: TOCTOU when setting specific permissions for Unix Doma...

CVE-2026-50025

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse MAM session...

CVE-2026-50025 Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse MAM session...

EUVD-2026-76693

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse MAM session...

CVE-2026-50025 Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse MAM session...

CVE-2026-50025

Mousehole is a background service that updates a seedbox IP for MyAnonamouse (MAM) and provides a web management interface. Prior to version 0.4.05 , its HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The root cause is th...

CVE-2026-50025 Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state

Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse MAM session...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

PoC — CVE-2026-39987 · Marimo Pre-Auth RCE CVSS 4.0: 9.3...

undici: undici: Denial of Service via unrequested WebSocket subprotocol

A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service DoS...

undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression

A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service DoS by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in t...