CVE-2026-9491

A Server-Side Request Forgery (SSRF) vulnerability in the webhook component of Synology Chat Server prior to 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information. The CVSS v3.1 score is 4.3 (Medium) with a network attack vector, low complexity, and low privileges requ...

CVE-2026-40541

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

CVE-2026-40541

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

CVE-2026-40541

Synology Chat Server before 2.4.5-22148 contains an improper input neutralization vulnerability in the extract domain component, classified as a cross-site scripting (XSS) flaw. Remote authenticated users can, through a UI interaction, read or write arbitrary files and trigger denial-of-service a...

EUVD-2026-67461

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

PT-2026-83259

Name of the Vulnerable Software and Affected Versions Microsoft Edge affected versions not specified Description A race condition exists in Copilot Chat, where concurrent execution using a shared resource with improper synchronization allows an authorized attacker to disclose information over a...

PT-2026-83027

CVE ID: CVE-2026-9548 Severity: MEDIUM | CVSS Score: 6.5/10 Severity and score come from CVSS ratings in the National Vulnerability Database NVD, the NIST repository of standardized vulnerability data. An improper neutralization of input during web page generation 'Cross-site Scripting'...

PT-2026-83026

A server-ide request forgery SSRF vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-9548: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks...

PT-2026-83307

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chat id/history, DELETE /chat/chat id, and POST /chat/chat id/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-58616: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Copilot Chat Microsoft Edge allows an authorized attacker to disclose information over a network...

PT-2026-83304

Kotaemon through 0.12.0 fails to properly validate conversation ownership in select conv, delete conv, rename conv, and on set public conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary...

CVE-2026-82281: Authorization Bypass Through User-Controlled Key

Kotaemon through 0.12.0 fails to properly validate conversation ownership in selectconv, deleteconv, renameconv, and onsetpublicconversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation...

CVE-2026-9491: Server-Side Request Forgery (SSRF)

A server-ide request forgery SSRF vulnerability in webhook in Synology Chat Server before 2.4.5-22148 allows remote authenticated users to obtain non-sensitive information...

CVE-2026-40541: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

PT-2026-82877

Name of the Vulnerable Software and Affected Versions Synology Chat Server versions prior to 2.4.5-22148 Description An improper neutralization of input during web page generation, known as Cross-site Scripting XSS, occurs in the extract domain component. This allows remote authenticated users,...

org.springframework.ai:spring-ai-starter-model-chat-memory-repository-redis (2.0.0) potentially affected by CVE-2026-59319 via org.springframework.ai:spring-ai-model-chat-memory-repository-redis (2.0.0)

org.springframework.ai:spring-ai-model-chat-memory-repository-redis MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.ai:spring-ai-model-chat-memory-repository-redis and may be impacted: -...

CVE-2026-59319

RedisChatMemoryRepository.findByMetadata builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape, unlike get, clear, and findByTimeRange in the same class which do escape their inputs. An application that passes user-controlled values to...

Circuit Discovery Helps Detect LLM Jailbreaking: A Mechanistic Interpretability Study

Despite extensive safety alignment, large language models LLMs remain vulnerable to jailbreak attacks that bypass safeguards to elicit harmful content. While prior work attributes this vulnerability to safety training limitations, the internal mechanisms by which LLMs process adversarial prompts...

CVE-2026-52103

A zero-click remote code execution RCE vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackers to execute arbitrary commands in the context of the application without user interaction via sending a crafted payload in a text message...