NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

#origin-check

0 stories this week · 1 this month · 2 in 6 months · mostly security

Stories per day · 30 days

Relatedcswsh1 macos1 textream1 websocket1

2 stories, newest first · one card per story

oss-security21d ago

Textream before 1.5.1 lacks Origin checks on its local WebSocket server

CVE-2026-28403 is rated CVSS 7.6 for cross-site WebSocket hijacking; both issues were fixed in 1.5.1.

1

oss-securityOct 6, 2026

CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one

CVE-2026-104380 lets Punk 0.48–0.54 route Extended CONNECT requests to GET routes without an Origin check.

cve-2026-104380 punk

2