Monthly
Cross-Site WebSocket Hijacking in Avaiga Taipy through version 4.1.1 lets any attacker-controlled web page open credentialed socket.io/WebSocket sessions to a victim's running Taipy application and drive it remotely. Because the socket.io server is configured with a wildcard CORS origin while also enabling the credentials flag, the browser attaches the victim's session and no CSRF token gates the channel, so a malicious site can silently modify GUI state variables and fire action callbacks on the victim's behalf. Reported by VulnCheck; no public exploit code and no active-exploitation (KEV) signal identified at time of analysis.
Cross-origin WebSocket session hijacking in Midscene Bridge Server through version 1.10.3 lets any web page a victim visits connect to the locally running Socket.IO server without an Origin check or authentication token, seizing the tool's single-client slot. Once connected, a remote attacker can intercept and inject browser-automation commands, exfiltrate command-payload data, or unconditionally kill the server via the MIDSCENE_BRIDGE_SIGNAL_KILL query parameter. Publicly available exploit code exists (reported by VulnCheck) and a vendor patch is available (commit 86f4118); no active exploitation has been confirmed.
Cross-origin information disclosure in the Apache Helix REST service (helix-rest) through 2.0.0 lets a remote attacker who lures an authenticated operator to a malicious web page read responses from and send requests to administrative REST endpoints. The CORSFilter unconditionally returns Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true and reflects arbitrary preflight method/header values, defeating the browser same-origin policy. There is no public exploit identified at time of analysis and EPSS risk is low (0.17%, 7th percentile), and it is not on the CISA KEV list.
Cross-site WebSocket hijacking in Eclipse Theia's browser backend (versions 1.8.1 and later) lets a foreign-origin web page reach the unauthenticated /services shell-terminal RPC namespace and execute arbitrary OS commands on the victim's host. The flaw stems from fail-open Origin validation in @theia/core combined with a client-controllable fix-origin header, so simply luring a developer running Theia to a malicious site yields remote code execution. There is no public exploit identified at time of analysis, and CVSS is rated 8.8 (High) driven by the user-interaction-only barrier.
Cross-Site WebSocket Hijacking in nanobot personal AI assistant (versions before 0.1.5) allows remote websites to establish unauthorized WebSocket connections to the local bridge server (ws://127.0.0.1:3001/), enabling WhatsApp session hijacking, message interception, QR code theft, and unauthorized message transmission. This vulnerability stems from incomplete remediation of CVE-2026-2577, where the added BRIDGE_TOKEN authentication is disabled by default and the server fails to validate the Origin header during WebSocket handshakes. Attack complexity is high (AC:H) but requires no authentication (PR:N), only user interaction (UI:R) such as visiting a malicious website while the bridge is running. No public exploit identified at time of analysis, though the technical details are fully disclosed in GitHub security advisory GHSA-v5j3-4q66-58cf.
Cross-site WebSocket hijacking in Network-AI (vendor: jovancoding) versions 5.0.0 up to but not including 5.15.2 lets an attacker-controlled web page open a WebSocket to the victim's loopback DashboardServer and read live agent topology - agent IDs, roles, task descriptions and token budgets. The upgrade handler performs no Origin or token check, so the connection is unauthenticated (CVSS PR:N), but exploitation still requires the victim to be actively running the dashboard and to be lured into loading a malicious page in a browser on the same host (UI:P), which keeps the CVSS 4.0 base score at 5.3 and our re-scored CVSS 3.1 at AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. Impact is confined to read-only reconnaissance - no write, disruption or code-execution component - and no public exploit code was identified at time of analysis.
Cross-origin WebSocket probing in the Punk Perl web framework (versions 0.48 up to but not including 0.55) allows a malicious web page to learn whether arbitrary GET paths, API operations, or mounted applications return a 2xx status. When Punk serves HTTP/2 or HTTP/3, an Extended CONNECT WebSocket handshake is routed as a GET by ps_serve_one, so it reaches every GET route while the Origin check - which only runs for matched websocket routes - is skipped; the handler's returned status becomes the handshake response, and any 2xx accepts the socket. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R): a victim must load an attacker-controlled cross-origin page that scripts the WebSocket, and it is not exploitable over HTTP/1.1. The impact is limited to endpoint and authorization probing - no response content, integrity, or availability impact - and no public exploit code was identified at time of analysis.
Cross-Site WebSocket Hijacking (CWE-1385) in RabbitMQ's Web-MQTT and Web-STOMP plugins allows attacker-controlled JavaScript running in a victim's browser to open an authenticated WebSocket connection to the broker, because the WebSocket upgrade handlers at rabbit_web_mqtt_handler.erl:104 and rabbit_web_stomp_handler.erl:102 never validate the Origin header. The flaw is only reachable under non-default configuration - Web-STOMP with use_http_auth=true, or either plugin with ssl_cert_login=true - where the browser automatically presents the victim's TLS client certificate, letting the attacker inherit the victim's identity; the issue is harmless under the default in-band CONNECT credential setup, so default deployments are unaffected. No public exploit has been identified at time of analysis, but the CVSS:3.1 assessment (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) rates the confidentiality and integrity impact as high where a vulnerable configuration is in use.
Missing origin validation in IBM Verify Identity Access and Security Verify Access (including their container editions) lets an unauthenticated, remote attacker ride an authenticated user's live session and carry out operations as that victim, potentially enabling follow-on attacks against the deployment. Exploitation requires the victim - a logged-in Verify Identity Access / Security Verify Access user - to be lured into visiting attacker-controlled web content while their session is active (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, 5.4), so confidentiality and integrity impact is limited to the victim's own privilege scope with no availability loss. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV); EPSS is 0.15% (4th percentile), and vendor-released fixes are available per IBM's advisory, making this a moderate-severity, likely low-priority issue in real-world terms.
Improper validation of the WebSocket origin in IBM i 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to read limited sensitive information by luring a logged-in user into a cross-origin WebSocket connection. The vulnerability requires user interaction (the victim must visit an attacker-controlled page) and yields only low confidentiality impact, giving a CVSS 3.1 base score of 4.3. There is no public exploit identified at time of analysis and CISA SSVC reports no active exploitation, so this is a low-urgency information-disclosure defect rather than an emergency patch item.
Cross-Site WebSocket Hijacking in Avaiga Taipy through version 4.1.1 lets any attacker-controlled web page open credentialed socket.io/WebSocket sessions to a victim's running Taipy application and drive it remotely. Because the socket.io server is configured with a wildcard CORS origin while also enabling the credentials flag, the browser attaches the victim's session and no CSRF token gates the channel, so a malicious site can silently modify GUI state variables and fire action callbacks on the victim's behalf. Reported by VulnCheck; no public exploit code and no active-exploitation (KEV) signal identified at time of analysis.
Cross-origin WebSocket session hijacking in Midscene Bridge Server through version 1.10.3 lets any web page a victim visits connect to the locally running Socket.IO server without an Origin check or authentication token, seizing the tool's single-client slot. Once connected, a remote attacker can intercept and inject browser-automation commands, exfiltrate command-payload data, or unconditionally kill the server via the MIDSCENE_BRIDGE_SIGNAL_KILL query parameter. Publicly available exploit code exists (reported by VulnCheck) and a vendor patch is available (commit 86f4118); no active exploitation has been confirmed.
Cross-origin information disclosure in the Apache Helix REST service (helix-rest) through 2.0.0 lets a remote attacker who lures an authenticated operator to a malicious web page read responses from and send requests to administrative REST endpoints. The CORSFilter unconditionally returns Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true and reflects arbitrary preflight method/header values, defeating the browser same-origin policy. There is no public exploit identified at time of analysis and EPSS risk is low (0.17%, 7th percentile), and it is not on the CISA KEV list.
Cross-site WebSocket hijacking in Eclipse Theia's browser backend (versions 1.8.1 and later) lets a foreign-origin web page reach the unauthenticated /services shell-terminal RPC namespace and execute arbitrary OS commands on the victim's host. The flaw stems from fail-open Origin validation in @theia/core combined with a client-controllable fix-origin header, so simply luring a developer running Theia to a malicious site yields remote code execution. There is no public exploit identified at time of analysis, and CVSS is rated 8.8 (High) driven by the user-interaction-only barrier.
Cross-Site WebSocket Hijacking in nanobot personal AI assistant (versions before 0.1.5) allows remote websites to establish unauthorized WebSocket connections to the local bridge server (ws://127.0.0.1:3001/), enabling WhatsApp session hijacking, message interception, QR code theft, and unauthorized message transmission. This vulnerability stems from incomplete remediation of CVE-2026-2577, where the added BRIDGE_TOKEN authentication is disabled by default and the server fails to validate the Origin header during WebSocket handshakes. Attack complexity is high (AC:H) but requires no authentication (PR:N), only user interaction (UI:R) such as visiting a malicious website while the bridge is running. No public exploit identified at time of analysis, though the technical details are fully disclosed in GitHub security advisory GHSA-v5j3-4q66-58cf.
Cross-site WebSocket hijacking in Network-AI (vendor: jovancoding) versions 5.0.0 up to but not including 5.15.2 lets an attacker-controlled web page open a WebSocket to the victim's loopback DashboardServer and read live agent topology - agent IDs, roles, task descriptions and token budgets. The upgrade handler performs no Origin or token check, so the connection is unauthenticated (CVSS PR:N), but exploitation still requires the victim to be actively running the dashboard and to be lured into loading a malicious page in a browser on the same host (UI:P), which keeps the CVSS 4.0 base score at 5.3 and our re-scored CVSS 3.1 at AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. Impact is confined to read-only reconnaissance - no write, disruption or code-execution component - and no public exploit code was identified at time of analysis.
Cross-origin WebSocket probing in the Punk Perl web framework (versions 0.48 up to but not including 0.55) allows a malicious web page to learn whether arbitrary GET paths, API operations, or mounted applications return a 2xx status. When Punk serves HTTP/2 or HTTP/3, an Extended CONNECT WebSocket handshake is routed as a GET by ps_serve_one, so it reaches every GET route while the Origin check - which only runs for matched websocket routes - is skipped; the handler's returned status becomes the handshake response, and any 2xx accepts the socket. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R): a victim must load an attacker-controlled cross-origin page that scripts the WebSocket, and it is not exploitable over HTTP/1.1. The impact is limited to endpoint and authorization probing - no response content, integrity, or availability impact - and no public exploit code was identified at time of analysis.
Cross-Site WebSocket Hijacking (CWE-1385) in RabbitMQ's Web-MQTT and Web-STOMP plugins allows attacker-controlled JavaScript running in a victim's browser to open an authenticated WebSocket connection to the broker, because the WebSocket upgrade handlers at rabbit_web_mqtt_handler.erl:104 and rabbit_web_stomp_handler.erl:102 never validate the Origin header. The flaw is only reachable under non-default configuration - Web-STOMP with use_http_auth=true, or either plugin with ssl_cert_login=true - where the browser automatically presents the victim's TLS client certificate, letting the attacker inherit the victim's identity; the issue is harmless under the default in-band CONNECT credential setup, so default deployments are unaffected. No public exploit has been identified at time of analysis, but the CVSS:3.1 assessment (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) rates the confidentiality and integrity impact as high where a vulnerable configuration is in use.
Missing origin validation in IBM Verify Identity Access and Security Verify Access (including their container editions) lets an unauthenticated, remote attacker ride an authenticated user's live session and carry out operations as that victim, potentially enabling follow-on attacks against the deployment. Exploitation requires the victim - a logged-in Verify Identity Access / Security Verify Access user - to be lured into visiting attacker-controlled web content while their session is active (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, 5.4), so confidentiality and integrity impact is limited to the victim's own privilege scope with no availability loss. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV); EPSS is 0.15% (4th percentile), and vendor-released fixes are available per IBM's advisory, making this a moderate-severity, likely low-priority issue in real-world terms.
Improper validation of the WebSocket origin in IBM i 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to read limited sensitive information by luring a logged-in user into a cross-origin WebSocket connection. The vulnerability requires user interaction (the victim must visit an attacker-controlled page) and yields only low confidentiality impact, giving a CVSS 3.1 base score of 4.3. There is no public exploit identified at time of analysis and CISA SSVC reports no active exploitation, so this is a low-urgency information-disclosure defect rather than an emergency patch item.