EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-3353)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

CVE-2026-86077: Missing Authorization

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

PT-2026-88447

In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node 1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false...

Linux Distros Unpatched Vulnerability : CVE-2026-19204

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and...

EulerOS 2.0 SP12 : libsoup (EulerOS-SA-2026-3278)

According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles requests that combine...

Exploit for Missing Authentication for Critical Function in Coreweave Marimo

CVE-2026-39987 PoC Summary Marimo = 0.20.4 is affected...

CVE-2026-86487

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

SUSE CVE-2026-19534

undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the client never requested. A default WebSocket connection sends no subprotocol, but if the server's 101 response includes a Sec-WebSocket-Protocol header, undic...

CVE-2026-86487

In JetBrains YouTrack versions before 2026.2.18634 , a crafted WebSocket message allowed read-only whiteboard users to modify canvas content. The flaw is an integrity issue: users who should have had read-only access could alter whiteboard drawings. The CVSS 3.1 score is 3.1 (LOW) , reflecting a ...

CVE-2026-86487

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

CVE-2026-86487

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

EUVD-2026-72503

In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content...

Sensitive Information Disclosure

org.springframework, spring-webflux is vulnerable to sensitive information disclosure. The vulnerability is due to request headers being included in the exception reason when handling WebSocket connections, which allows an attacker to potentially obtain indirectly sensitive user information by...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its WebSocket frame parsing, where a frame carrying an unknown opcode bypasses the maximum frame size validation and its declared payload length is allocated before the opcode is...

ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +431 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.1.0.alpha0, <=12.1.11)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.1.0.alpha0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =4.13.5, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.3 and more Source cves: CVE-2026-19204 Source advisory: SNYK:JAVA-ORGECLIPSEJETTYWEBSOCKET-19644206...

au.csiro.pathling:fhir-server (>=7.0.0, <=7.2.0), br.com.archbase:archbase-annotation-processor (>=2.1.2, <=2.1.21) +292 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.0.0.alpha0, <=12.0.37)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.0.0.alpha0, =7.0.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-19204 Source advisory:...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

DEBIAN-CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

UBUNTU-CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...