10234 matches found
nextssrf
╔══════════════════════════════════════════════════════════════╗ ║ NextSSRF — CVE-2026-44578 Scanner & Exploit ║ ║ Next.js WebSocket Upgrade Handler SSRF ║ ║ Affected: 13.4.13 → 15.5.15, 16.0.0 → 16.2.4 ║ ║ @mitsec / ynsmroztas — Bug Bounty Tooling ║...
CLEANSTART-2026-KF40182 undici's WebSocket client crashes the whole Node
Security vulnerability affects the n8n package. undici's WebSocket client crashes the whole Node...
GHSA-4HV6-XC92-J86G Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: DELETE /api/v2/user/sessions/id documents "Revokes a specific session by its UUID", and enabling TOTP calls DeleteAllUserSessions to invalidate all sessions. The WebSocket endpoint accepts any cryptographically vali...
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
Summary Vikunja v2.6.0 introduced server-side sessions with revocation semantics: DELETE /api/v2/user/sessions/id documents "Revokes a specific session by its UUID", and enabling TOTP calls DeleteAllUserSessions to invalidate all sessions. The WebSocket endpoint accepts any cryptographically vali...
Updated tomcat package fixes security vulnerabilities
OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. CVE-2026-73581 Cross-context authentication mix-up with Jakarta Authentication configured. CVE-2026-75973 Bypass of security constraints for WebSocket endpoints. CVE-2026-76183 Transfer-Encoding honored for...
MGASA-2026-0479 Updated tomcat package fixes security vulnerabilities
OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. CVE-2026-73581 Cross-context authentication mix-up with Jakarta Authentication configured. CVE-2026-75973 Bypass of security constraints for WebSocket endpoints. CVE-2026-76183 Transfer-Encoding honored for...
CVE-2026-107807
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...
CVE-2026-107807 Nginx UI: Node Secret Credential Exposure via URL Query Parameter
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...
BIT-THRIFT-2026-92834 Apache Thrift: C++ WebSocket server transport does not read a full request length
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
BIT-THRIFT-2026-83745 Apache Thrift, Apache Thrift: WebSocket frame decoders allocate the payload buffer from the declared length, not the bytes received (Node.js, D)
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...
CVE-2026-107909
A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...
CVE-2026-107909
FalkorDB versions before 4.20.0 are vulnerable to a pre-authentication heap out-of-bounds write in the ws_read_frame and buffer_apply_mask functions. This occurs because WebSocket frames with a 64-bit extended payload length are not properly bounded; the existing check is an ASSERT() that is omit...
EUVD-2026-95486
A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...
CVE-2026-107909 Pre-authentication heap out-of-bounds write in FalkorDB Bolt WebSocket frame handling via unbounded payload length
A heap-based out-of-bounds write in the wsreadframe function src/bolt/ws.c and the bufferapplymask function src/bolt/buffer.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit...
CLEANSTART-2026-OA48166 Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance
Security vulnerability affects the apache2 package. Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance...
PT-2026-109199
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
Rocky Linux 9 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2026_76750)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676750 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequested...
Wireshark 1.12.x < 1.12.5 Multiple Vulnerabilities (macOS)
The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 1.12.5. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-1.12.5 advisory. - The detectversion function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x...
PT-2026-109184
Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings. Both bindings' WebSocket server transports read the payload length out of the frame header and allocate that many bytes immediately, without...
CVE-2026-107807: Cleartext Storage of Sensitive Information
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the nodesecret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently...