agentprime: CWE-1385

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

Fri, 23 Oct 2026 18:29:02 GMT

obsidian-tc <1.3.1, fixed in 1.3.1. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-55463: Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

Fri, 23 Oct 2026 14:17:06 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-107858: Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

Fri, 23 Oct 2026 05:08:46 GMT

CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-112085: webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades

Thu, 22 Oct 2026 09:31:59 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85267: Cross-Site WebSocket Hijacking in Google Cloud Shell

Tue, 20 Oct 2026 09:16:56 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-109330: Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer

Mon, 12 Oct 2026 16:05:19 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one

Tue, 06 Oct 2026 01:13:14 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Fri, 02 Oct 2026 23:09:15 GMT

headroom-ai <0.35.0, fixed in 0.35.0. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-67405: RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)

Wed, 23 Sep 2026 20:41:14 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54565: rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages

Thu, 17 Sep 2026 20:19:10 GMT

CVSS 4.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-13272: Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

Mon, 14 Sep 2026 20:13:07 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-18251: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

Mon, 14 Sep 2026 19:38:07 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-88061: career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution

Thu, 10 Sep 2026 19:08:23 GMT

CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85183: Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

Thu, 03 Sep 2026 14:12:21 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-15580: PassPortal browser extension: vault token disclosure via unvalidated postMessage

Fri, 21 Aug 2026 14:00:10 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Thu, 16 Jul 2026 20:14:34 GMT

mcp <1.28.1, fixed in 1.28.1. CVSS 7.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-57111: Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin

Thu, 09 Jul 2026 07:09:05 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-59804: Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket

Wed, 08 Jul 2026 19:42:52 GMT

CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-10054: Missing authentication in Eclipse Foundation Eclipse Theia

Fri, 03 Jul 2026 10:11:32 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

Fri, 08 May 2026 20:43:17 GMT

cline <=2.13.0, no fixed version yet. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Kubetail has a Cross-Site WebSocket Hijacking issue that allows attacker to read Kubernetes logs from authenticated users

Thu, 07 May 2026 02:34:32 GMT

github.com/kubetail-org/kubetail/modules/cli <0.16.0, fixed in 0.16.0. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints

Tue, 21 Apr 2026 15:13:01 GMT

github.com/0xJacky/Nginx-UI <1.9.10-0.20260316053337-1a9cd29a3082, fixed in 1.9.10-0.20260316053337-1a9cd29a3082. CVSS 5.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-35589: nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)

Tue, 14 Apr 2026 22:47:32 GMT

CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

Next.js: null origin can bypass dev HMR websocket CSRF checks

Tue, 17 Mar 2026 15:29:48 GMT

next >=16.0.1, <16.1.7, fixed in 16.1.7. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Storybook Dev Server is Vulnerable to WebSocket Hijacking

Thu, 26 Feb 2026 15:16:10 GMT

storybook >=8.1.0, <8.6.17 || >=8.7.0-alpha.0, <9.1.19 || >=10.0.0-beta.0, <10.2.10, fixed in 8.6.17, 9.1.19, 10.2.10. CVSS 8.9 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-1692: Missing origin validation in GraphicalData web service requests

Thu, 26 Feb 2026 07:55:18 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-68930: Traccar Missing Origin Validation in WebSockets

Mon, 23 Feb 2026 20:44:29 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

@farmfe/core is Missing Origin Validation in WebSocket

Thu, 12 Feb 2026 18:30:23 GMT

@farmfe/core <1.7.6, fixed in 1.7.6. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Mailpit is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) allowing unauthenticated access to emails

Tue, 13 Jan 2026 15:11:42 GMT

github.com/axllent/mailpit <0.0.0-20260110031614 || >=1.2.6, <1.28.2, fixed in 0.0.0-20260110031614, 1.28.2. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Bokeh server applications have Incomplete Origin Validation in WebSockets

Tue, 06 Jan 2026 17:53:44 GMT

bokeh <3.8.2, fixed in 3.8.2. CVSS 4.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-61987: Japan Total System Co.,Ltd. GroupSession Free edition: GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3…

Fri, 12 Dec 2025 05:02:22 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Canonical LXD Vulnerable to Privilege Escalation via WebSocket Connection Hijacking in Operations API

Thu, 02 Oct 2025 21:19:29 GMT

github.com/canonical/lxd >=0.0.0-20200331193331-03aab09f5b5c, <0.0.0-20250827065555-0494f5d47e41 || >=4.0, <5.21.4 || >=6.0, <6.5, fixed in 0.0.0-20250827065555-0494f5d47e41, 5.21.4, 6.5. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability

Sun, 03 Aug 2025 12:30:30 GMT

org.apache.zeppelin:zeppelin-shell >=0.11.1, <0.12.0, fixed in 0.12.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-36116: IBM Db2 Mirror for i cross-site websocket hijacking

Wed, 23 Jul 2025 14:26:06 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Claude Code Improper Authorization via websocket connections from arbitrary origins

Mon, 23 Jun 2025 21:22:22 GMT

@anthropic-ai/claude-code >=0.2.116, <1.0.24, fixed in 1.0.24. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Information exposure in Next.js dev server due to lack of origin verification

Wed, 28 May 2025 21:52:13 GMT

next >=13.0, <14.2.30 || >=15.0.0, <15.2.2, fixed in 14.2.30, 15.2.2. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-8201: Cross-Site WebSocket Hijacking Vulnerability in Hitachi Ops Center Analyzer

Fri, 16 May 2025 06:32:23 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening

Tue, 04 Feb 2025 17:00:57 GMT

vitest <=0.0.125 || >=1.0.0, <1.6.1 || >=2.0.0, <2.1.9 || >=3.0.0, <3.0.5, fixed in 1.6.1, 2.1.9, 3.0.5. CVSS 9.7 (Critical). Critical: CVSS score 9.7: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-48849: Authentication and Authorization Issues

Wed, 29 Jan 2025 18:23:59 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Websites were able to send any requests to the development server and read the response in vite

Tue, 21 Jan 2025 19:52:55 GMT

vite <4.5.6 || >=5.0.0, <5.4.12 || >=6.0.0, <6.0.9, fixed in 4.5.6, 5.4.12, 6.0.9. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-23168: Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting in the arbitrary code execution.

Thu, 15 Aug 2024 00:00:00 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-32264: CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2.

Fri, 08 Mar 2024 20:48:07 GMT

CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-49805: Uptime Kuma Missing Origin Validation in WebSockets

Mon, 11 Dec 2023 22:37:04 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-2848: Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability.

Thu, 14 Sep 2023 11:36:50 GMT

CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

Unintentional leakage of private information via cross-origin websocket session hijacking

Tue, 25 Jul 2023 18:04:28 GMT

nodebb <2.8.13 || >=3.0.0, <3.1.3, fixed in 2.8.13, 3.1.3. CVSS 4.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2023-2886: Cross-Site WebSocket Hijacking in CBOT's Chatbot

Thu, 25 May 2023 08:31:24 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-30856: eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution

Fri, 28 Apr 2023 15:54:54 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

code-server vulnerable to Missing Origin Validation in WebSockets

Thu, 23 Mar 2023 06:30:15 GMT

code-server <4.10.1, fixed in 4.10.1. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2023-0957: An issue was discovered in Gitpod versions prior to release-2022.11.2.16.

Fri, 03 Mar 2023 07:00:41 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2014-125071: lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websockets

Mon, 09 Jan 2023 20:45:48 GMT

CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.