f textream vulnerabilities

Latest f textream CVEs

Newest publication first

1. CVE-2026-28412 Textream Vulnerable to Uncontrolled Resource Consumption (Denial of Service)

   Published 2026-03-02

   High·CVSS 7.5 EPSS 0.34%

   Textream is a free macOS teleprompter app. Prior to version 1.5.1, the DirectorServer WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flo...

2. CVE-2026-28403 Textream Cross-Site WebSocket Hijacking (CSWSH) vulnerability

   Published 2026-03-02

   High·CVSS 7.6 EPSS 0.17%

   Textream is a free macOS teleprompter app. Prior to version 1.5.1, the DirectorServer WebSocket server (ws://127.0.0.1:<httpPort+1>) accepts connections from any origin without validating the HTTP Origin header during the WebSocket handshake. A malicious web page visited in the s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.