https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 12 Nov 2026 20:45:05 +0000 https://db.gcve.eu/vuln/cve-2026-125361 <p><strong>Affected:</strong> Tencent BrowserSkill</p> <p>Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension&#39;s full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.</p> <p><strong>Affected:</strong> Tencent BrowserSkill</p> <p>Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to impersonate the bsk daemon because remoteSocket() connects to the loopback WebSocket without credentials or peer verification. Attackers who bind the daemon port before it starts or after it exits receive the extension&#39;s full tool surface, including evaluate, to run JavaScript through CDP in logged-in browser tabs.</p> https://db.gcve.eu/vuln/cve-2026-125361