CVE-2026-85183Critical· 9.3▾ AbyssalPoC availableTaipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitra…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 51.2 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Exploit / PoC code exists
0.2% → 0.2%
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48544High· 7.5Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthenticated attackers to escape the intended module directory by …
CVE-2026-109330Medium· 4.3Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation
CVE-2026-59804Medium· 6.8Midscene Bridge Server through 1.10.3, fixed in commit 86f4118, contains a missing authentication and CORS misconfiguration vulnerability that allows unauthenticated remote attackers to hijack active bridge sessions by opening a cross-or…
CVE-2026-71416High· 8.8Headroom compresses data before the data reaches a large language model
CVE-2026-55463Medium· 6.5Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation
CVE-2026-107858High· 7.2Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server