Tag
AV Stumpfl Pixera Two Media Server Code Injection Vulnerability
2 rules 1 TTP 1 CVEA remote code injection vulnerability exists in AV Stumpfl Pixera Two Media Server versions up to 25.2 R2 due to improper handling within the Websocket API, potentially allowing unauthenticated attackers to execute arbitrary code.
OpenClaw Unauthenticated WebSocket Denial-of-Service Vulnerability
2 rules 1 TTP 1 CVEOpenClaw before 2026.3.28 is vulnerable to a denial-of-service attack by accepting unbounded concurrent unauthenticated WebSocket upgrades, allowing attackers to exhaust server resources.
PraisonAI Unauthenticated Remote Session Hijacking Vulnerability (CVE-2026-40289)
2 rules 5 TTPs 1 CVEPraisonAI versions before 4.5.139 and praisonaiagents versions before 1.5.140 are vulnerable to unauthenticated remote session hijacking due to missing authentication and a bypassable origin check on the /ws WebSocket endpoint, enabling unauthorized remote control and data leakage.
PraisonAI Unauthenticated WebSocket Allows Resource Exhaustion
2 rules 1 TTP 1 CVEPraisonAI before version 4.5.128 is vulnerable to resource exhaustion and API credit draining due to the `/media-stream` WebSocket endpoint accepting unauthenticated connections, allowing attackers to exhaust server resources and drain OpenAI API credits.
Mesop Framework WebSocket Denial-of-Service Vulnerability (CVE-2026-34824)
2 rules 2 TTPsAn unauthenticated attacker can exploit an uncontrolled resource consumption vulnerability in Mesop versions 1.2.3 to 1.2.4 by sending a rapid succession of WebSocket messages, leading to thread exhaustion and a denial-of-service condition.
PraisonAI Gateway Unauthenticated Access Vulnerability
2 rules 1 TTP 1 CVEPraisonAI Gateway server versions prior to 4.5.97 allow unauthenticated access to WebSocket connections and agent topology, enabling unauthorized message sending and agent enumeration.
NATS Server WebSocket Frame Length Overflow Denial of Service
2 rules 1 TTPA vulnerability in NATS server allows a remote, unauthenticated attacker to cause a denial of service by sending a crafted WebSocket frame, leading to a server crash due to missing validation on WebSocket frame length.
Multiple Vulnerabilities in SWITCH EV Charging Stations
2 rules 7 TTPs 1 IOCMultiple vulnerabilities in SWITCH EV swtchenergy.com charging stations could allow attackers to impersonate stations, hijack sessions, cause denial of service, and manipulate backend data due to missing authentication, rate limiting issues, session expiration flaws, and exposed credentials.
PrefectHQ Prefect Authentication Bypass Vulnerability (CVE-2026-7723)
2 rules 1 TTP 1 CVEPrefectHQ Prefect versions up to 3.6.13 are vulnerable to an authentication bypass via manipulation of the /api/events/in WebSocket endpoint, potentially allowing remote attackers to execute unauthorized actions.
Signal K Server WebSocket Login Brute-Force Vulnerability
1 rule 1 TTPThe Signal K server's WebSocket login endpoint lacks rate limiting, allowing attackers to bypass HTTP rate limiting by opening a WebSocket connection and attempting unlimited password guesses.