PULSEUnderground Intel

EN VIVO35señales / 24h

FEED

ransompanzer reclama a SUNNIER HOMES · Retail & E-Commerceransomn0n reclama a LiveRamp · US · Technologyransomn0n reclama a DraftKings · US · Retail & E-Commerceransominterlock reclama a Garden Valley School Division · CA · Educationransommedusalocker reclama a Capetownransombravox reclama a AWO Bundesverband · DE · Otherransomdark project reclama a MTM&O Gold Refinery DMCC · AE · Manufacturingransomdark project reclama a Bear Valley Community Hospital · US · Healthcareransomplay reclama a NY Snacks · US · Retail & E-Commerceransomplay reclama a BROTHERS EXPRESS LLC · US · Transportationransomplay reclama a Signworx · GB · Otherransomsilentransomgroup reclama a A&O Shearman · GB · Professional Servicesransomsilentransomgroup reclama a J...ransomhyflock reclama a tcadarwin · AU · Otherransompanzer reclama a SUNNIER HOMES · Retail & E-Commerceransomn0n reclama a LiveRamp · US · Technologyransomn0n reclama a DraftKings · US · Retail & E-Commerceransominterlock reclama a Garden Valley School Division · CA · Educationransommedusalocker reclama a Capetownransombravox reclama a AWO Bundesverband · DE · Otherransomdark project reclama a MTM&O Gold Refinery DMCC · AE · Manufacturingransomdark project reclama a Bear Valley Community Hospital · US · Healthcareransomplay reclama a NY Snacks · US · Retail & E-Commerceransomplay reclama a BROTHERS EXPRESS LLC · US · Transportationransomplay reclama a Signworx · GB · Otherransomsilentransomgroup reclama a A&O Shearman · GB · Professional Servicesransomsilentransomgroup reclama a J...ransomhyflock reclama a tcadarwin · AU · Other

← Todos los CVEs

CVE Watch10 nov 2026

CVE-2026-111249

The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Publicado: 10 nov 2026 · Última mod.: 10 nov 2026 · CWE-1327

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of changed files in the watched folder and the server version, and reach the deployed applications through the additional port. This only affects LiveReload enabled in the embedded Maven plugin. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Referencias oficiales

lists.apache.orghttps://lists.apache.org/thread/sssq84vj136dz964j1ooyr20jc9s6pnm

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-97849—

——0The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.14h CVE-2026-1121368.8 ALT

——0A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.13h CVE-2026-1192497.5 ALT

——8A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to obtain information about the host device.11d CVE-2026-591778.8 ALT

——20ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.8d CVE-2026-1123469.8 CRÍ

——19OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.6d CVE-2026-925599.8 CRÍ

——14IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.19d