CVE-2026-65318 Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

CVE-2026-65318 Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...

GHSA-2X63-GW47-W4MM websocket-driver-ruby: Denial of service via malformed Host header

Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...

websocket-driver-ruby: Denial of service via malformed Host header

Impact If this library is used to implement a WebSocket server on top of a TCP server, by using the WebSocket::Driver.server method, then a client can cause the server to crash by sending a Host header that is not a valid host:port string. When this happens, a URI::InvalidURIError exception is...

Malicious code in websokcet-client (PyPI)

Source: checkmarx f0b369f36d362252e5b97f85a376e1dd139b93adf34683f97365aa0f16afb861 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-lient (PyPI)

Source: checkmarx 167f66c15160a1a310640f5863b0995a3a49c8e139d6c2e2995e15ad3df705cf Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-lcient (PyPI)

Source: checkmarx 06fe78dfaf7de4fc0f3b80d29f70f2adfac22a5446be0781ebadd88b23a66f2f Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clientt (PyPI)

Source: checkmarx 33cf4131351db40feeeab46a20ef29dbf2694a7cfbaf07b5927603a5dd8e4f03 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cient (PyPI)

Source: checkmarx ac94b737cfa799516c0c831332c0d3406bf24089725787a5a884703605f8af9a Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clinet (PyPI)

Source: checkmarx 6638db5357088a77a9ccb3e2f2754c8ba7c10746f703e3ae4b586548318faeef Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cclient (PyPI)

Source: checkmarx 3200072ca23fb3f9d041940f3e7bb0306e92c438c53c2d08cbb020c7879f835c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clien (PyPI)

Source: checkmarx fdd107331bf3e46620076f654463266a9f8f024454379ef04288aba0e0af540c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clieent (PyPI)

Source: checkmarx 4feae31dcf666a30e8848da752d72614ca03bd3c60eedb2f69a4de43eb9f7560 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cliennt (PyPI)

Source: checkmarx ce81626c97864e772e307901ca4c296db0ea985a4296d6d5c910615cc6b94efa Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clint (PyPI)

Source: checkmarx e2ed5b9c8a0271395a5e0407624dd18f8b28071aee5588b73ad595d0d126499a Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cllient (PyPI)

Source: checkmarx db7751b36861392ace123440141ea620167cf864cb8690f562a26d303f21245e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-clietn (PyPI)

Source: checkmarx 81783882612ba7b6fae545c40b498a476222def4eab8e8b779ff41cefcb93e3d Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cliet (PyPI)

Source: checkmarx 06412b694edd65cdb47e2702e6629ceb27ac0ab4d17846860a687a380d14c94c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in websocket-cleint (PyPI)

Source: checkmarx b95022cf171781e9a5b50900b78390fa8ba1d016e8c2e34ff9e7fbf2d900ceed Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet addresses --- Credit: OpenSSF source...

Malicious code in ryry-cli (PyPI)

Source: amazon-inspector 4a305ba94c92b6ec62aaf627fc1213d9e37e1645f37fd033f61c7becaba71edd ryry-cli runs as a long-lived agent that connects to a hardcoded WebSocket at wss://api.dalipen.com/aigc/task/connect and executes Python scripts under subprocess.Popen based on task messages sent by that...