EUVD-2026-96913

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-87764

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

CVE-2026-87764

The BuddyPress Instant Chat WordPress plugin (versions through 1.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to verify if a chat message sender belongs to the intended conversation, combined with a lack of output encoding for message content. This allows u...

EUVD-2026-96772

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

CVE-2026-87764 BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

x64dbg

x64dbg Un debugger binario open source per Windows, pensato per l'analisi di malware e il reverse engineering di eseguibili di cui non si possiede il codice sorgente. Sono disponibili molte funzionalità e un completo sistema di plugin per aggiungere le proprie. Puoi trovare maggiori informazioni...

CVE-2026-108689

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant...

EUVD-2026-96712

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant...

CVE-2026-108689 Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant...

CVE-2026-108689

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant...

CVE-2026-108689 Wukong AICRM through 20260610 Authorization Bypass via User-Controlled Session ID in POST /chat/send

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant...

CVE-2026-108689

Wukong AICRM (versions through 20260610 ) is vulnerable to an authorization bypass (CWE-639) due to a missing authorization check on the POST /chat/send endpoint. This flaw allows an authenticated attacker to provide an arbitrary sessionId to write messages into another user's AI chat session. By...

EUVD-2026-96552

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens...

CVE-2026-108689: Authorization Bypass Through User-Controlled Key

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant...

PT-2026-109983

Name of the Vulnerable Software and Affected Versions Wukong AICRM versions prior to 20260611 Description An authorization flaw allows authenticated users to write into the AI chat sessions of other users. By providing an arbitrary sessionId to the 'POST /chat/send' endpoint, an attacker can appe...

CVE-2026-108748: Missing Release of Memory after Effective Lifetime

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

PT-2026-110150

🚨 CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket / chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId,...

PT-2026-110046

Name of the Vulnerable Software and Affected Versions BuddyPress Instant Chat versions prior to 1.7 Description Unauthenticated users can store arbitrary web scripts that execute in the session of any member who views the affected conversation. This occurs because the plugin fails to verify if th...

CVE-2026-87764: Improper Neutralization of Input During Web Page Generation

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

CVE-2026-108879: Authorization Bypass Through User-Controlled Key

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId,...