CVE-2026-72742 DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The...

CVE-2026-65675

Technical details (affected product/version, root cause, exploitability) are not publicly available in the provided documents; monitor for updates.

EUVD-2026-56437

No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-65675 CoPilot Chat Security Feature Bypass Vulnerability

...

CVE-2026-65675 CoPilot Chat Security Feature Bypass Vulnerability

...

CoPilot Chat Security Feature Bypass Vulnerability

No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-65675: Missing Authorization

No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-70661

Name of the Vulnerable Software and Affected Versions Visual Studio Code CoPilot Chat Extension affected versions not specified Description An unauthorized attacker can bypass a security feature over a network within the Visual Studio Code CoPilot Chat Extension. Recommendations At the moment,...

EUVD-2026-55846

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender ...

CVE-2026-72730

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

CVE-2026-72724

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/oneboxhandler.rb resolves Chat::Thread by route threadid independently of the route channelid before checking whether the user can preview the selected chat channel. An...

CVE-2026-72730 Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

CVE-2026-72730 Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

EUVD-2026-55670

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

CVE-2026-72730

Discourse stores a chat-transcript username as HTML in the Rich Text Editor, enabling stored XSS for versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. Fixed in those listed versions. CVSS 3.1 base score 8.7 (NETWORK, LOW complexity, LOW privileges, USER interaction required). No explo...

CVE-2026-72730

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

CVE-2026-72730 Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

EUVD-2026-55663

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/oneboxhandler.rb resolves Chat::Thread by route threadid independently of the route channelid before checking whether the user can preview the selected chat channel. An...

CVE-2026-72724

Discourse vulnerability CVE-2026-72724 affects the chat onebox flow. Prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before verifying preview permissions, allowing ...

CVE-2026-72724

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/oneboxhandler.rb resolves Chat::Thread by route threadid independently of the route channelid before checking whether the user can preview the selected chat channel. An...