CVE-2026-18179

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

CVE-2026-18179 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

EUVD-2026-85325

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

CVE-2026-18179

The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to an issue where a remote attacker can clear active chat sessions. This is caused by improper authorization (CWE-862). The vulnerability impacts versions 4.0.6.0 - 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800...

CVE-2026-18179 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

PT-2026-97421

Name of the Vulnerable Software and Affected Versions Kotaemon versions prior to 0.12.1 Description The multi-user chat interface contains improper access controls and incorrect authorization. Four handler methods in libs/ktem/ktem/pages/chat/control.py load conversation records using only the...

Cinnamon's Kotaemon contains improper authorization checks in Kotaemon multi‑user chat handlers

Overview Cinnamon's Kotaemon all versions up to v0.12.0 multi‑user chat interface does not verify conversation ownership when loading a conversation. Any authenticated user can read, delete, rename, or overwrite another user’s conversation data by supplying the correct ID. This results in...

CVE-2026-18179: Missing Authorization

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

CVE-2026-86867: Exposure of Sensitive Information to an Unauthorized Actor

Cinnamon's Kotaemon all versions up to and including v0.12.0 multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in libs/ktem/ktem/pages/chat/control.py that load a Conversation record by its ID...

PT-2026-97678

This module provides integration of the tawk.to live chat for Drupal sites. The module does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions through a Cross-Site Request Forgery CSRF vulnerability...

PT-2026-97323

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization...

CVE-2026-75511 Novu: Server-Side Request Forgery (SSRF) via Chat Provider Webhook URLs

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu accepts chat webhook URLs from subscriber credentials.webhookUrl, channel endpoint endpoint.url, event payload.webhookUrl, and event overrides.webhookUrl, then passes the selected endpoint.url through...

Malicious Package

Overview chat-adapter-matrix is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-77525

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path applicationid but load records using global chatid and chatrecordid values without confirming that the chat belongs to the authorized application. A normal user in the...

CVE-2026-77519 MaxKB: Expired application API keys remain usable on `/chat/api/mcp`

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the ispermanent and expiretime checks used by the standard chat API. A previously valid,...

CVE-2026-77519 MaxKB: Expired application API keys remain usable on `/chat/api/mcp`

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the ispermanent and expiretime checks used by the standard chat API. A previously valid,...

CVE-2026-77519

MaxKB (an open-source enterprise AI assistant) versions 2.10.2-lts and earlier contain an authentication inconsistency in the /chat/api/mcp endpoint. The MCP authentication path validates ApplicationApiKey using only the secret and active status, omitting the is_permanent and expire_time checks e...

CVE-2026-91921

Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...

EUVD-2026-83880

Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...

CVE-2026-91921

CVE-2026-91921 is a Cross-Site Scripting (XSS) vulnerability in the client-side rendering engine of the 1millionbot AI Chat Platform , caused by inadequate input sanitisation. An unauthenticated remote user can trigger the issue by sending messages containing Markdown syntax and certain unsanitis...