Cline kanban npm package cross-origin WebSocket hijack (CVSS 9.6) — referenced in 2026-05-14 § 7 drop note (out-of-window)
cve · CVE-2026-44211
Coverage timeline
1
first 2026-05-14 → last 2026-05-14
Briefs
1
1 distinct
Sources cited
20
15 hosts
Sections touched
0
—
Co-occurring entities
0
no co-occurrence
Story timeline
- 2026-05-14CTI Daily Brief — 2026-05-14
Source distribution
- bleepingcomputer.com3 (15%)
- thehackernews.com3 (15%)
- securityaffairs.com2 (10%)
- blog.talosintelligence.com1 (5%)
- dexpose.io1 (5%)
- elastic.co1 (5%)
- haveibeenpwned.com1 (5%)
- heise.de1 (5%)
- other7 (35%)
External references
All cited sources (20)
- bleepingcomputer.cominlineBleepingComputer 2026-05-05https://www.bleepingcomputer.com/news/security/new-stealthy-quasar-linux-malware-targets-software-developers/
- bleepingcomputer.cominlineBleepingComputer, 2026-05-06https://www.bleepingcomputer.com/news/security/video-service-vimeo-confirms-anodot-breach-exposed-user-data/
- bleepingcomputer.cominlineBleepingComputer, 2026-05-08https://www.bleepingcomputer.com/news/security/zara-data-breach-exposed-personal-information-of-197-000-people/
- blog.talosintelligence.cominlineCisco Talos 2026-05-05https://blog.talosintelligence.com/uat-8302/
- dexpose.ioinlineDeXpose, 2026-05-20https://www.dexpose.io/rhysida-ransomware-targets-landeshauptstadt-stuttgart/
- elastic.coinlineElastic Security Labs 2026-05-07https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan
- haveibeenpwned.cominlineHave I Been Pwnedhttps://haveibeenpwned.com/Breach/Charter
- heise.deinlineHeise Online (EN), 2026-05-21https://www.heise.de/en/news/Cyber-gang-Rhysida-claims-data-theft-from-Stuttgart-city-11301876.html
- huntress.cominlineHuntress, 2026-06-03https://www.huntress.com/blog/unpatched-ntlm-leak-windows-search-uri-handler
- microsoft.cominlineMicrosoft Security Blog 2026-05-04https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/
- newsroom.adt.cominlineADT Newsroom, 2026-04-24https://newsroom.adt.com/corporate-news/adt-detects-cybersecurity-incident
- oasis.securityinlineOasis Security 2026-05-07https://www.oasis.security/blog/cline-kanban-websocket-hijack
- securityaffairs.cominlineSecurityAffairs, 2026-05-08https://securityaffairs.com/191859/cyber-crime/zara-data-breach-197000-customers-exposed-in-third-party-security-incident.html
- securityaffairs.cominlineSecurity Affairs, 2026-05-30https://securityaffairs.com/192907/uncategorized/shinyhunters-leaks-charter-communications-data-potentially-impacting-5-million-customers.html
- tenetsecurity.aiinlineTenet Security, 2026-06-12https://tenetsecurity.ai/blog/agentjacking-coding-agents-with-fake-sentry-errors/
- thehackernews.cominlineThe Hacker News 2026-05-04https://thehackernews.com/2026/05/progress-patches-critical-moveit.html
- thehackernews.cominlineThe Hacker News, 2026-06-12https://thehackernews.com/2026/06/agentjacking-attack-tricks-ai-coding.html
- thehackernews.cominlineThe Hacker News, 2026-06-03https://thehackernews.com/2026/06/unpatched-windows-search-uri.html
- theregister.cominlineThe Register, 2026-05-05https://www.theregister.com/2026/05/05/shinyhunters_dump_puts_119k_vimeo/
- vimeo.cominlineVimeo official blog, 2026-04-27https://vimeo.com/blog/post/anodot-third-party-security-incident
Items in briefs about Cline kanban npm package cross-origin WebSocket hijack (CVSS 9.6) — referenced in 2026-05-14 § 7 drop note (out-of-window)
No parsed item heading or body matches this entity yet. Items match by exact CVE id (for CVE entities), by lead-segment substring of the title in the item heading or body, or by a distinctive anchor token from the title appearing in the item heading. Coverage that lives inside a broader section (no per-item heading) is captured by the Story timeline above.