PT-2026-55298

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting missing user-identifier predicates in the chunk model semanticSearch method...

PT-2026-55407

Summary SQLChatAgent in langroid ships a validate query defense-in-depth layer whose DANGEROUS SQL PATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family pg read file, pg stat file, pg ls logdir...

Linux Distros Unpatched Vulnerability : CVE-2026-57963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This...

chat-with-mlx (>=0.1.0, <=0.1.5), megatts (3.0.0) potentially affected by CVE-2026-49119 via gradio (4.19.1)

gradio PYPI version 4.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - chat-with-mlx =0.1.0, =0.1.5 - megatts 3.0.0 Source cves: CVE-2026-49119 Source advisory: OSV:GHSA-J36P-7W88-G82J...

eevee-chat (>=0.0.1, <=0.0.2.post1) potentially affected by CVE-2026-49119 via gradio (4.23.0)

gradio PYPI version 4.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - eevee-chat =0.0.1, =0.0.2.post1 Source cves: CVE-2026-49119 Source advisory: OSV:GHSA-J36P-7W88-G82J...

screenenv (0.0.1.dev0), simple-voice-chat (>=4.0.1, <=4.2.3) +1 more potentially affected by CVE-2026-49119 via gradio (5.23.1)

gradio PYPI version 5.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - screenenv 0.0.1.dev0 - simple-voice-chat =4.0.1, =4.2.3 - zmp-knowledge-store-mcp-server 0.1.0 Source cves: CVE-2026-49119 Source advisory:...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2026-49119 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2026-49119 Source advisory: OSV:GHSA-J36P-7W88-G82J...

chat-with-mlx (>=0.1.0, <=0.1.5), megatts (3.0.0) potentially affected by CVE-2026-49119 via gradio (4.19.1)

gradio PYPI version 4.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - chat-with-mlx =0.1.0, =0.1.5 - megatts 3.0.0 Source cves: CVE-2026-49119 Source advisory: OSV:PYSEC-2026-2179...

eevee-chat (>=0.0.1, <=0.0.2.post1) potentially affected by CVE-2026-49119 via gradio (4.23.0)

gradio PYPI version 4.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - eevee-chat =0.0.1, =0.0.2.post1 Source cves: CVE-2026-49119 Source advisory: OSV:PYSEC-2026-2179...

screenenv (0.0.1.dev0), simple-voice-chat (>=4.0.1, <=4.2.3) +1 more potentially affected by CVE-2026-49119 via gradio (5.23.1)

gradio PYPI version 5.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - screenenv 0.0.1.dev0 - simple-voice-chat =4.0.1, =4.2.3 - zmp-knowledge-store-mcp-server 0.1.0 Source cves: CVE-2026-49119 Source advisory:...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2026-49119 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2026-49119 Source advisory: OSV:PYSEC-2026-2179...

DRUPAL-CONTRIB-2026-068

This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently re-evaluate a human-in-the-loop approval gate where the workflow iterates more than once. This may result in execution of workflows that were not intended by the use...

DRUPAL-CONTRIB-2026-067

This module enables you to test and run AI-driven workflows interactively through a chat interface. The module doesn't sufficiently enforce permissions on certain endpoints. Attackers may be able to trigger workflow execution incurring LLM spend and tool side effects or send messages into other...

DRUPAL-CONTRIB-2026-065

The Canvas AI submodule allows you to upload image files via a custom API to use within the AI web chat. These file uploads are insufficiently validated before being written to Drupal's temporary directory. In some cases, this may lead to cross-site scripting XSS...

Fake Interpol Investigation Emails Push Ransomware at Small Businesses Globally

Fake Interpol investigation emails are targeting small businesses with Proton Drive links that deliver ransomware, encrypt files, and route victims to Tox chat...

UBUNTU-CVE-2026-57963

An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1...

CVE-2026-57963

An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1...

CVE-2026-57963

The Thunderbird email client is vulnerable to a chat UI manipulation flaw where an attacker sending HTML chat messages (via Matrix or XMPP ) can inject arbitrary styled content , phishing links , and CSS to manipulate the chat interface. This issue was addressed in versions 152.0.1 and 140.12.1 ....

CVE-2026-57963 Chat UI manipulation by injection

An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1...

CVE-2026-57963 Chat UI manipulation by injection

An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1...