Все уязвимости

Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades

Nginx-UI vulnerable to Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints

Kubetail: Cross-Site WebSocket Hijacking allows attacker to read Kubernetes logs from authenticated users

obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access

Cross-Site WebSocket Hijacking in Google Cloud Shell

Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)

Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer

Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket

Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one

Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS

RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)

rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Bokeh server applications have Incomplete Origin Validation in WebSockets

Vite allows any websites to send any requests to the development server and read the response

Information exposure in Next.js dev server due to lack of origin verification

PassPortal browser extension: vault token disclosure via unvalidated postMessage

Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin

In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged term

Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

nanobot: Cross-Site WebSocket Hijacking in WhatsApp Bridge (CVE-2026-2577 Fix Update)

Missing origin validation in GraphicalData web service requests

Next.js: null origin can bypass dev HMR websocket CSRF checks

Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API

Traccar Missing Origin Validation in WebSockets