By weakness (CWE)

CWE-1385: related vulnerabilities

CVEs classified under CWE-1385. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

3 published vulnerabilities

• CVE-2026-10054HIGH 8.8

  Eclipse Theia versions 1.8.1 and later contain a critical flaw in how they secure terminal access over WebSocket connections. The vulnerability allows an attacker to execute arbitrary OS commands on a system running Theia by exploiting missing authentication on the terminal RPC endpoints. A user simply needs to visit a malicious website while their Theia instance is running; that website can then connect to the terminal service, create a new terminal session, and run commands—all without any authentication or permission check. The root cause involves two failures: WebSocket origin validation is disabled by default, and the Socket.IO integration trusts a client-controlled header instead of the real browser Origin header, allowing attackers to spoof their connection source.

• CVE-2026-57111HIGH 7.5

  Apache Helix exposes administrative REST API endpoints to unauthorized cross-origin requests due to overly permissive CORS (Cross-Origin Resource Sharing) configuration. An attacker who tricks a user with legitimate access to visit a malicious web page can make requests to these administrative endpoints from the attacker's domain, potentially reading sensitive responses or performing administrative actions. The vulnerability exists in versions through 2.0.0 and is fixed in 2.0.1.

• CVE-2026-59804MEDIUM 6.8

  Midscene Bridge Server versions up to 1.10.3 fail to validate the origin of incoming WebSocket connections and do not require authentication tokens. An attacker can open a malicious website, and when a victim visits it, the attacker's page can connect to the victim's local Socket.IO server without any authentication. Once connected, the attacker can take over the active bridge session, intercept automation commands, inject malicious instructions, steal data from command payloads, or crash the server entirely. The vulnerability requires user interaction—the victim must visit a malicious site—but once triggered, it grants near-complete control over any active Midscene Bridge automation.