tfc

Tinfoil Chat Tinfoil Chat TFC is a FOSS+FHD peer-to-peer messaging system that relies on high assurance hardware architecture to protect users from passive collection, MITM attacks and most importantly, remote key exfiltration. TFC is designed for people with one of the most complex threat models...

CVE-2026-108879

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId,...

CVE-2026-108879 JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId,...

CVE-2026-108879 JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId,...

EUVD-2026-97053

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId,...

CVE-2026-108879

JeecgBoot versions through 3.9.5 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability within the AiragBaseApiController component. This flaw allows authenticated users to access other users' AI chat variables by sending POST requests to the /airag/api/getChatVariable endpoin...

CVE-2026-108852

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to...

CVE-2026-108852 Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to...

EUVD-2026-97003

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to...

CVE-2026-108852 Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass

Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to...

CVE-2026-108852

Deep Chat version 2.5.1 is vulnerable to a cross-site scripting (XSS) flaw due to a Markdown link validation bypass . The root cause is that the RemarkableConfig.createNew function disables Remarkable link validation, allowing attackers to inject javascript: links. Attackers can execute scripts i...

CVE-2026-108748

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

EUVD-2026-96913

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-87764

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

CVE-2026-87764 BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

EUVD-2026-96772

The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor does it escape message content before outputting it back, allowing unauthenticated users to store arbitrary web scripts that will execute...

CVE-2026-87764

The BuddyPress Instant Chat WordPress plugin (versions through 1.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to verify if a chat message sender belongs to the intended conversation, combined with a lack of output encoding for message content. This allows u...

x64dbg

x64dbg Un debugger binario open source per Windows, pensato per l'analisi di malware e il reverse engineering di eseguibili di cui non si possiede il codice sorgente. Sono disponibili molte funzionalità e un completo sistema di plugin per aggiungere le proprie. Puoi trovare maggiori informazioni...