Apache Tomcat 9.0.0.M1 < 9.0.121 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 9.0.121. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat9.0.121security-9 advisory. - Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issu...

Malicious code in ulid-xyz (npm)

ulid-xyz is a typosquat of the popular ulid library sortable unique IDs and is a cross-platform Remote Access Trojan delivered via a postinstall hook. The package.json postinstall superficially looks like an inline node -e guard that checks for the existence of a dist file, but it actually launch...

Malicious code in forge-jsx4 (npm)

forge-jsx4 is a remote access trojan RAT published to the public npm registry by the account rafaelsilva [email protected]. Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control...

Malicious code in @sheltr_/agent (npm)

Source: amazon-inspector 0ecc4dcd6d76f100601f8b37a6b9c3aab899770ab361f2714f9193a2f8d0db78 When the package's bin entry is run, it spawns an interactive PTY shell using $SHELL with the user's full process environment and HOME as the working directory, then opens a WebSocket connection to a hardcod...

Malicious code in vanexa-agent (npm)

Source: amazon-inspector 433bc5b1e6814e9c9a1f5d4ff26e2dbb31fdb8a5e9a08f9c94696347dcbeb803 When the daemon is started vanexa-agent start, it opens a WebSocket to the hardcoded relay wss://vanexa-agent-relay.hanazaki542.workers.dev/ws/daemon/ and dispatches incoming taskrequest messages into an...

Malicious code in sakuraai (npm)

Source: amazon-inspector d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e When the daemon is started e.g. via sakura daemon start, the package binds an HTTP+WebSocket server on 0.0.0.0 and additionally exposes it via a Tailscale sidecar. The WebSocket handler spawns an interactive...

Malicious code in @whalent/agent (npm)

Source: amazon-inspector 0d9a3395e3bbc1bae774ea99bb4100a3db071a6b4527eaba0ae9089eb51bf268 The package ships as an agent daemon whose bundled entry dist/index.cjs, dist/core.cjs connects to a hardcoded WebSocket gateway at wss://memory.whalent.com/gw/sdk/ws and executes commands received from the...

Malicious code in codeam-cli (npm)

Source: amazon-inspector 2e8b39baa6129e1e1988002fcbeb2f62464f84fc7458f82f3754d1033a9b4ca6 codeam-cli spawns a node-pty pseudo-terminal wrapping the local Claude Code / Codex agent process and connects outbound over WebSocket to a hardcoded relay at https://api.codeagent-mobile.com. Messages...

Malicious code in agentto (npm)

Source: amazon-inspector 8cd82c93e5f7bc0005dec9fbf18f01ec45bb6e6d2fb97bad2479c0209a7414bf [email protected] opens a WebSocket to the hardcoded server wss://link.agentto.net and routes terminal. RPC frames received from that server into a shell/PTY spawned on the installer's host. The terminal.input...

Malicious code in @whalent/agent-core (npm)

Source: amazon-inspector dfd40ffe52986a560961c8d4d9d7a3ec526813f9a2f335cef9c6884ca9f6d2cf The package's bundled runtime dist/index.cjs opens a WebSocket to a hardcoded gateway at wss://memory.whalent.com/gw/sdk/ws and integrates with node-pty and childprocess spawn to run terminal sessions SHELL ...

Malicious code in @vibelet/cli (npm)

Source: amazon-inspector 3f3dc6503f9f63413994c6d0b2e19f22ebcf17f5e7ba9f713ce26ecf69c92c6c The @vibelet/cli package ships a daemon bundle dist/index.cjs, invoked by the vibelet bin and by vibelet start/restart/reset that starts an HTTP+WebSocket server, spawns an interactive PTY running...

Malicious code in @spzhongwin/skill-logger-plugin (npm)

Source: amazon-inspector 970980f38a6389d5b622ca41ba3b418f1538b2a38f595536c97acb934012b8b9 The package advertises itself as a skill usage/error logger but, when activated via the openclaw gatewaystart hook, opens a persistent WebSocket to a hardcoded default endpoint at wss://aishuo.co/gateway/ws...

Malicious code in @yeaft/webchat-agent (npm)

Source: amazon-inspector f9c505d42f1b2b4f64592abbf753ebf4b8eb5e11d359bc4fb8b8a9a9db3ec36e On startup the agent opens a WebSocket to a configurable server SERVERURL / config.serverUrl, default ws://localhost:3456 and dispatches server-originated messages to handlers on the installer's host...

Malicious code in isite (npm)

Source: amazon-inspector 08f0ac64df493f0f780dab52b41f561daedaf70c2a6c9cb62fe51307f89d29fe On initialization of the framework index.js - init, lib/wsClient.js opens a WebSocket to ws://socket.social-browser.com/isite URL hidden by a custom base64-alphabet decoder in object-options/lib/fn.js...

OPENSUSE-SU-2026:21448-1 Security update for agama-web-ui

This update for agama-web-ui fixes the following issues: - CVE-2025-7783: form-data: unsafe Math.random function is used to select a boundary value for multipart form-encoded data bsc1246822. - CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames bsc1272310....

CVE-2026-59898

A flaw was found in netty-codec-http. The WebSocket handshaker in this component fails to properly validate protocol version information during the WebSocket upgrade process. A remote attacker can exploit this vulnerability by manipulating the WebSocket handshake, leading to a bypass of security...

resterm v0.47.3

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

[SECURITY] Fedora 43 Update: libwebsockets-4.5.8-2.fc43

This is the libwebsockets C library for lightweight websocket clients and servers...

[SECURITY] Fedora 44 Update: libwebsockets-4.5.8-1.fc44

This is the libwebsockets C library for lightweight websocket clients and servers...

Malicious code in @aicommander/agent (npm)

Source: amazon-inspector 9a0d4917f10db91a59e47821bfa2399801219a85da0a59b8596d85fd3931fc93 @aicommander/agent installs a remote-machine agent that opens an outbound WebSocket to the hardcoded relay https://aicommander.dev and executes shell commands received over that channel on the installer's...