SAP patches CVSS 10.0 PROXYGATE and ICM2SHELL flaws
Onapsis found no exploitation; network attackers can run commands as the SAP installation owner, <sid>adm.
1
Stories per day · 30 days
4 RSS
Relatedcurl2gnutls2ubuntu2aws-sigv41cswsh1information-disclosure1macos1origin-check1proxygate1remote-code-execution1sap1sap-gateway1textream1usn1
21 stories, newest first · one card per story
Stories tagged #websocket
Textream before 1.5.1 lacks Origin checks on its local WebSocket server
CVE-2026-28403 is rated CVSS 7.6 for cross-site WebSocket hijacking; both issues were fixed in 1.5.1.
Ubuntu 26.10 curl update fixes WebSocket read and reuse bugs
USN-8927-2 backports fixes for an out-of-bounds read and a connection-reuse flaw, CVE-2026-107928 and CVE-2026-107929.
USN-8927-1: curl vulnerabilities
Ubuntu’s USN-8927-1 patches curl flaws that may leak data or reuse the wrong network interface.
Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time
Cisco Talos says UAT-11985 uses a Google AiTM kit to steal sessions from Taiwan-linked researchers.
CVE-2026-102489 | Technical Details
Zammad flaw CVE-2026-102489 leaks WebSocket session cookies unauthenticated, enabling hijack and RCE, and is in CISA KEV.
8
PoC Released for Zammad Session Leak Flaw Enabling Remote Code Execution
Horizon3.ai released a PoC for Zammad CVE-2026-102489 that leaks session cookies and can yield remote code execution.
6
PoC Exploit Released for Zammad Vulnerability Enabling Session Hijacking and Remote Code Execution
Researchers released a PoC for critical Zammad flaw CVE-2026-102489 enabling session hijacking and remote code execution.
1
Re: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-107363) errata 1
OpenStack assigned CVE-2026-107363 to a Zaqar WebSocket flaw enabling cross-project queue access.
Zammad CVE-2026-102489: Session Leak to RCE
Horizon3.ai details Zammad zero-day CVE-2026-102489, abused in the DIVD breach to leak sessions and run code.
9
Monta monta.app
CISA says unauthenticated WebSocket flaws in every Monta monta.app version could let attackers control charging stations.
Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
Apache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
VSCode's SSH Agent Is Bananas
Thomas Ptacek details how VSCode Remote SSH installs a persistent WebSocket agent with filesystem, file-editing, and shell access, resembling remote-access tooling.
CVE-2026-77791: Apache Tomcat: DoS via busy wait during WebSocket close
Apache Tomcat WebSocket close handling can busy-wait, enabling denial of service across multiple supported versions.
CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints
Apache Tomcat CVE-2026-76183 lets attackers bypass security constraints on any WebSocket endpoint.
Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs
Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.
1
Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds
Attacker exploited unauthenticated marimo WebSocket RCE CVE-2026-39987 to steal AWS credentials and SSH into a bastion host in eight seconds.
6
Hackers Exploit Marimo RCE to Steal AWS Credentials and Reach Bastion Host in 8 Seconds
Attackers exploited pre-auth RCE CVE-2026-39987 in Marimo notebooks to steal AWS credentials and SSH into a bastion host in eight seconds.
2
Human Attacker Hits Machine-Speed Exploitation of Marimo RCE
Sysdig details a human attacker chaining pre-auth RCE in Marimo (CVE-2026-39987) to AWS credentials and a bastion host in eight seconds.
4
Broken Access control on Websocket streams
Fortinet FortiSOAR access control flaw (CVSS 4.9) lets zero-permission authenticated attackers subscribe to and inject broadcast messages into websocket streams.