CVE-2026-111702 ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/id or the knowledgebaseId parameter of POST...

CVE-2026-111702

The ChatOllama software (specifically through commit 96c3ce5) contains an Insecure Direct Object Reference (IDOR) vulnerability. This flaw allows remote attackers to access other users' private knowledge bases by supplying sequential identifiers. Attackers can enumerate these IDs using the GET /a...

EUVD-2026-103040

CoAI Chat Nio through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated...

WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Anatoly Gorbounov x1will in WordPress Plugin 2Way VideoCalls and Random Chat versions = 6.1.5...

securitybot

Securitybot Distributed alerting for the masses! Securitybot is an open-source implementation of a distributed alerting chat bot, as described in Ryan Huber's blog post. Distributed alerting improves the monitoring efficiency of your security team and can help you catch security incidents faster...

CVE-2025-6792

Exploit: Unauthorized Pusher Channel Subscription Eavesdropping 1 Obtain Pusher credentials from browser console console.log window.wpguppyscriptsvars.pusherKey, window.wpguppyscriptsvars.pusherCluster ; 2 Subscribe to a victim’s private channel Pusher Eavesdrop Test Listening on private-user-5...

PT-2026-116029

abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers holding the Chat permission can call...

PT-2026-116105

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing...

PT-2026-116101

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/id or the knowledgebaseId parameter of POST...

PT-2026-116106

99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values...

PT-2026-116017

CoAI Chat Nio through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated...

L4J-Vuln-Patch

NOTICE This tool is no longer necessary mojang has released its own patch which should cover everyone who is affected https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition WARNING THIS EXPLOIT EFFECTS BOTH CLIENTS AND SERVERS There is currently a exploit...

CVE-2026-42228

GHSA-f77h-j2v7-g6mw — n8n Unauthenticated Chat Execution Hijacking CVE: CVE-2026-42228 Severity: High Affected: n8n 1.123.32 Fixed in: n8n 1.123.32 / 2.17.4 / 2.18.1 Vulnerability Summary chat-service.ts :: startSession accepts an executionId from the WebSocket query string and only checks that t...

CVE-2025-51401

Exploit Title: LiveHelperChat 4. Save the changes. 5. Initiate a chat with a visitor. 6. Transfer the chat to another operator — the XSS payload executes in the receiving operator’s chat interface...

CVE-2026-30048

CVE-2026-30048 - Stored Cross-Site Scripting XSS in NotChatbot WebChat Video Demonstration https://youtu.be/HklaoNKP9H8 Steps to Reproduce 1. Integrate the WebChat widget using the official package/CDN 2. Open the chat int...

CVE-2025-51869

CVE-2025-51869 Vulnerability description Liner is a reliable AI search engine with over 10 million users worldwide. Liner construct a search engine based on LLM, which is vulnerable to Insecure Direct Object Reference IDOR in its chat component. An attacker can exploit this IDOR to tamper other...

CVE-2026-66750-Insufficient-Access-Controls-Allow-for-Unauthorized-File-Downloads-Let-s-Chat-

Security Advisory: Insufficient Access Controls Allow for Unauthorized File Downloads Let's Chat Assigned CVE ID: CVE-2026-66750 Summary GET /files/:id/:name checks that the caller is logged in and then serves the file. It never checks whether the caller is allowed to see the room the file belong...

CVE-2026-36228

CVE-2026-36228: Easy Chat Server 3.1 Chat Message mtowho Denial of Service PoC This repository contains a benign-by-default proof of concept for CVE-2026-36228, a denial-of-service issue in Easy Chat Server 3.1 chat message handling. This repository is for authorized security research and local...

CVE-2025-56515

CVE-2025-56515 Cross-Site Scripting XSS Vulnerability in Fiora Chat Application CVE-2025-56515: Cross-Site Scripting XSS Vulnerability in Fiora Chat Application Vulnerability Overview CVE ID : CVE-2025-56515 Vulnerability Type : Cross-Site Scripting XSS Attack Type : Remote Impact : Code Executio...

CVE-2025-51858

CVE-2025-51858 Vulnerability description ChatPlayground.ai is a popular web application for comparing AI models. A Cross-Site Scripting XSS vulnerability exists in the chat component. This can lead to JWT token theft and remote account hijacking. Additionally, the /api/chat-history endpoint...