CVE-2026-77363 | High | 8.8 | 2026-10-12 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the H… |
CVE-2026-109330 | Medium | 4.3 | 2026-10-12 | Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topol… |
CVE-2026-104380 | Medium | 5.3 | 2026-10-06 | Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one.
On HTTP/2 and HTTP/3 a… |
CVE-2026-67405 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt… |
CVE-2026-54565 | Medium | 4.7 | 2026-09-17 | rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions… |
CVE-2026-13272 | Medium | 5.4 | 2026-09-14 | IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further… |
CVE-2026-18251 | Medium | 4.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin. |
CVE-2026-71416 | High | 8.8 | 2026-09-11 | Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin`… |
CVE-2026-88061 | | | 2026-09-10 | career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-sp… |
CVE-2026-85183 | Critical | 9.3 | 2026-09-03 | Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connecti… |
CVE-2026-15580 | | | 2026-08-21 | vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse.
This issue affects the PassPortal browser e… |
CVE-2026-59950 | High | 8.1 | 2026-07-15 | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.we… |
CVE-2026-57111 | High | 7.5 | 2026-07-09 | Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache Helix through 2.0.0 on… |
CVE-2026-59804 | Medium | 6.8 | 2026-07-08 | Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthent… |
CVE-2026-10054 | High | 8.8 | 2026-07-03 | In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /service… |
CVE-2026-44211 | Critical | 9.6 | 2026-06-01 | Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerab… |
CVE-2026-44514 | Medium | 6.5 | 2026-05-14 | Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate th… |
CVE-2026-34403 | High | 8.1 | 2026-04-20 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with Ch… |
CVE-2026-35589 | High | 8.0 | 2026-04-14 | nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket ser… |
CVE-2026-27977 | Medium | 5.4 | 2026-03-18 | Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next dev`, cross-site protec… |
CVE-2026-1692 | Medium | 6.1 | 2026-02-26 | A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features… |
CVE-2025-68930 | High | 7.1 | 2026-02-23 | Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in the `/api/… |
CVE-2025-56647 | Medium | 6.5 | 2026-02-12 | npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting… |
CVE-2026-22689 | Medium | 6.5 | 2026-01-10 | Mailpit is an email testing tool and API for developers. Prior to version 1.28.2, the Mailpit WebSocket server is configured to accept connections from any ori… |
CVE-2026-21883 | Medium | 5.4 | 2026-01-08 | Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp… |
CVE-2025-61987 | Medium | 5.3 | 2025-12-12 | GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. do not validate origins in WebSoc… |
CVE-2025-54289 | High | 8.1 | 2025-10-02 | Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions… |
CVE-2024-51775 | Medium | 5.3 | 2025-08-03 | Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.
The attacker could access the Zeppelin server from another origin without any restri… |
CVE-2025-36116 | Medium | 6.3 | 2025-07-23 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthentic… |
CVE-2025-52882 | | | 2025-06-24 | Claude Code is an agentic coding tool. Claude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Py… |
CVE-2025-48068 | Medium | 4.3 | 2025-05-30 | Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js ma… |
CVE-2024-8201 | Medium | 5.4 | 2025-05-16 | Cross-Site WebSocket Hijacking vulnerability in Hitachi Ops Center Analyzer (RAID Agent component).This issue affects Hitachi Ops Center Analyzer: from 10.8.0-… |
CVE-2025-24964 | Critical | 9.6 | 2025-02-04 | Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest… |
CVE-2024-48849 | Critical | 9.4 | 2025-01-29 | Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS requests. This issue affec… |
CVE-2025-24010 | Medium | 6.5 | 2025-01-20 | Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to defa… |
CVE-2024-23168 | Critical | 9.8 | 2024-08-15 | Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary cod… |
CVE-2023-32264 | Medium | 5.8 | 2024-03-08 | CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. The vulnerability could allow upload arbitrary code and execute it on the… |
CVE-2023-49805 | Medium | 6.0 | 2023-12-11 | Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify tha… |
CVE-2023-2848 | High | 8.0 | 2023-09-14 | Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability. This was the result of a missing header validation. |
CVE-2023-2850 | Medium | 4.7 | 2023-07-25 | NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin. Exploitation of this vulnerability allows… |
CVE-2023-2886 | Medium | 4.3 | 2023-05-25 | Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation.
This issue affects Chatbot: be… |
CVE-2023-30856 | High | 8.3 | 2023-04-28 | eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing th… |
CVE-2023-26114 | High | 8.2 | 2023-03-23 | Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow… |
CVE-2023-0957 | High | 8.2 | 2023-03-03 | An issue was discovered in Gitpod versions prior to release-2022.11.2.16. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers… |
CVE-2014-125071 | Medium | 5.5 | 2023-01-09 | A vulnerability was found in lukehutch Gribbit. It has been classified as problematic. Affected is the function messageReceived of the file src/gribbit/request… |