CWE-1385

CVEs per yearBy the year they were published

1. 20238
2. 20242
3. 202510
4. 202629

Newest CVEs

• CVE-2026-55463

  Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation

  intranda · goobi-viewer-core

  Medium6.5
• CVE-2026-107858

  Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server

  Google · Agent Development Kit (ADK) for Java

  High7.2
• CVE-2026-112085

  webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades

  webpack-dev-server · webpack-dev-server

  High8.2
• CVE-2026-85267

  Cross-Site WebSocket Hijacking in Google Cloud Shell

  Google Cloud · Cloud Shell

  High8.7
• CVE-2026-77363

  obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access

  The-40-Thieves · obsidian-tc

  High8.8
• CVE-2026-109330

  Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer

  Jovancoding · Network-AI

  Medium5.3
• CVE-2026-104380

  Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one

  Punk

  Medium5.3
• CVE-2026-67405

  RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)

  rabbitmq · rabbitmq-server

  Medium5.3
• CVE-2026-54565

  rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages

  edwardkim · rhwp

  Medium4.7
• CVE-2026-13272

  Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

  IBM · Verify Identity Access

  Medium5.4

Vendors it comes up for most

1. IBM3
2. Apache Software Foundation2
3. vercel2
4. 0xJacky1
5. ABB1
6. Avaiga1
7. CBOT1
8. Canonical1
9. Eclipse Foundation1
10. GitSquared1