CWE-1385
50 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 50Published CVEs50 of them scored
- 31Last 12 monthspublished in the last year
- 4Critical20 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-125358
Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink
rehan-remade · universal-modder
High7.2 - CVE-2026-55463
Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation
intranda · goobi-viewer-core
Medium6.5 - CVE-2026-107858
Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server
Google · Agent Development Kit (ADK) for Java
High7.2 - CVE-2026-112085
webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
webpack-dev-server · webpack-dev-server
High8.2 - CVE-2026-85267
Cross-Site WebSocket Hijacking in Google Cloud Shell
Google Cloud · Cloud Shell
High8.7 - CVE-2026-77363
obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access
The-40-Thieves · obsidian-tc
High8.8 - CVE-2026-109330
Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer
Jovancoding · Network-AI
Medium5.3 - CVE-2026-104380
Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one
Punk
Medium5.3 - CVE-2026-67405
RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)
rabbitmq · rabbitmq-server
Medium5.3 - CVE-2026-54565
rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages
edwardkim · rhwp
Medium4.7