CVEs classified under CWE-1385, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (21)
CVE-2024-23168 — CVSS 9.8 (critical): Vulnerability in Xiexe XSOverlay before build 647 allows non-local websites to send the malicious commands to the WebSocket API, resulting…
CVE-2025-24964 — CVSS 9.6 (critical): Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious…
CVE-2024-48849 — CVSS 9.4 (critical): Missing Origin Validation in WebSockets vulnerability in FLXEON. Session management was not sufficient to prevent unauthorized HTTPS…
CVE-2025-52882: Claude Code is an agentic coding tool. Claude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs…
CVE-2026-34403 — CVSS 8.1 (high): Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a…
CVE-2025-54289 — CVSS 8.1 (high): Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal…
CVE-2026-35589 — CVSS 8.0 (high): nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the…
CVE-2025-68930 — CVSS 7.1 (high): Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain a Cross-Site WebSocket Hijacking (CSWSH)…
CVE-2026-44514 — CVSS 6.5 (medium): Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard exposes WebSocket endpoints that did not…
CVE-2025-56647 — CVSS 6.5 (medium): npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate…
CVE-2026-22689 — CVSS 6.5 (medium): Mailpit is an email testing tool and API for developers. Prior to version 1.28.2, the Mailpit WebSocket server is configured to accept…
CVE-2025-36116 — CVSS 6.3 (medium): IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted…
CVE-2026-1692 — CVSS 6.1 (medium): A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue…
CVE-2023-32264 — CVSS 5.8 (medium): CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. The vulnerability could allow upload arbitrary code…
CVE-2026-27977 — CVSS 5.4 (medium): Next.js is a React framework for building full-stack web applications. Starting in version 16.0.1 and prior to version 16.1.7, in `next…
CVE-2026-21883 — CVSS 5.4 (medium): Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist…
CVE-2025-61987 — CVSS 5.3 (medium): GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. do not…
CVE-2024-51775 — CVSS 5.3 (medium): Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin. The attacker could access the Zeppelin server from another origin…
CVE-2025-48068 — CVSS 4.3 (medium): Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to…
CVE-2023-2886 — CVSS 4.3 (medium): Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue…