CVE-2026-1692

The record

A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website. This vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect.

Affected packages

Related vulnerabilities

• CVE-2026-85183 Taipy configures its socket.io server with wildcard CORS origin and credential flag… CWE-1385
• CVE-2026-59950 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-1385
• CVE-2026-57111 Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest… CWE-1385
• CVE-2026-10054 In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes… CWE-1385
• CVE-2026-44211 Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. CWE-1385
• CVE-2026-44514 Kubetail is a real-time logging dashboard for Kubernetes. CWE-1385
• GHSA-5c57-rqjx-35g2 Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability CWE-1385
• CVE-2026-34403 Nginx UI is a web user interface for the Nginx web server. CWE-1385