37 matches found
EUVD-2025-23599
Malicious code in bioql PyPI...
CVE-2025-58177 n8n stored cross-site scripting in LangChain Chat Trigger node initialMessages parameter
n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting XSS vulnerability in @n8n/n8n-nodes-langchain.chatTrigger. An authorized user can configure the LangChain Chat Trigger node with malicious JavaScript in the initialMessages...
CVE-2025-54868
LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to stored chats in the Meilisearch engine without...
CVE-2025-54868 LibreChat exposes arbitrary chats through Meilisearch engine
LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to stored chats in the Meilisearch engine without...
CVE-2025-51867
CVE-2025-51867 affects Deepfiction AI and is an Insecure Direct Object Reference (IDOR) vulnerability exploiting the /browse/stories endpoint to let an attacker chat with the LLM using other users’ credits. Root cause: improper access controls exposing sensitive information tied to user credits. ...
CVE-2024-7040
In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admin page, administrators are intended to view only the chats of non-admin members. However, by modifying the userid parameter, it is possible to view the chats of any administrator,...
CVE-2024-7040
...
PT-2025-12178 · Unknown · Open-Webui
Name of the Vulnerable Software and Affected Versions: open-webui/open-webui version v0.3.8 Description: The issue is related to improper access control. Administrators are supposed to view only the chats of non-admin members on the frontend admin page. However, it is possible to view the chats o...
ZOHO ManageEngine Endpoint Central 安全漏洞
ZOHO ManageEngine Endpoint Central is a desktop management system from ZOHO USA. A security vulnerability exists in ZOHO ManageEngine Endpoint Central versions prior to 11.3.2440.09. An attacker can exploit the vulnerability to change usernames in chat...
CVE-2024-42514
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthorized access attack due to inadequate access control checks. A successful exploit requires user interaction and could allow an attacker to...
PT-2022-26037 · Relatedcode · Relatedcode'S Messenger
Name of the Vulnerable Software and Affected Versions: Relatedcode's Messenger version 7bcd20b Description: The issue allows an authenticated external attacker to access existing chats in the workspaces of any user of the application. This is possible because the application does not validate...
CVE-2022-41708
Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of the application. This is possible because the application does not validate permissions correctly...
CVE-2021-27653
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure...
CVE-2021-27653
Misconfiguration of the Pega Chat Access Group portal in Pega platform 7.4.0 - 8.5.x could lead to unintended data exposure...
Unspecified Vulnerability in Telegram Desktop (CNVD-2021-38323)
Telegram is an instant messaging mobile application.Telegram Desktop is the desktop version of Telegram. A security vulnerability exists in Telegram Desktop version 2.4.3 and earlier, which stems from a password not being required to be entered when the export key is pressed in the Export Telegra...
Code injection
Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export...