[ Vendor · 6 CVEs ]
stoatchat
CVEs affecting stoatchat published in the last 30 days, plus any stoatchat CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100674 | 26 Sep 2026 | CVSS 4.3 | stoatchatstoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by… | |
| CVE-2026-100675 | 26 Sep 2026 | CVSS 6.5 | stoatchatstoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages… | |
| CVE-2026-100676 | 26 Sep 2026 | CVSS 8.2 | stoatchatJanuary, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local… | |
| CVE-2026-100677 | 26 Sep 2026 | CVSS 5.3 | stoatchatstoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses… | |
| CVE-2026-100678 | 26 Sep 2026 | CVSS 6.5 | stoatchatstoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP… | |
| CVE-2026-100679 | 26 Sep 2026 | CVSS 8.8 | stoatchatstoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own… |