CVE-2026-65644

CVE-2026-65644 is a stored XSS in Rocket.Chat's Omnichannel livechat visitor name field, rendered via dangerouslySetInnerHTML in InquireSidePanelItem.tsx, allowing unauthenticated attackers to inject clickable links into agent views. Patch PR #41595 fixes it in versions 7.10.15 and 8.1.8+. Exploi...

PT-2026-79291

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...

Rocket.Chat: Stored HTML Injection (CWE-79) via Livechat Visitor Name

Vulnerability description not provided...

CVE-2026-48616

Rocket.Chat versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rcroomtype=l with rcrid+rctoken, but the authorization path does not verify...

CVE-2026-48616

CVE-2026-48616 affects Rocket.Chat Livechat file downloads in multiple legacy branches (versions

CVE-2026-48616

Rocket.Chat versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Protected file downloads at /file-upload/:fileId/:name authorize livechat access using rcroomtype=l with rcrid+rctoken, but the authorization path does not verify...

PT-2026-50128

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 8.5.1 Rocket.Chat versions prior to 8.4.4 Rocket.Chat versions prior to 8.3.6 Rocket.Chat versions prior to 8.2.6 Rocket.Chat versions prior to 8.1.6 Rocket.Chat versions prior to 8.0.7 Rocket.Chat versions prior ...

Rocket.Chat: Unauthenticated reading of every file via livechat auth and predicting MongoDB ObjectId()

Vulnerability description not provided...

New Phishing Scam Uses LiveChat to Pose as Amazon and PayPal in Real Time

Cofense researchers warn of a phishing scam where attackers use LiveChat to impersonate Amazon and PayPal agents and steal credit card and MFA codes...

EUVD-2024-36639

Malicious code in bioql PyPI...

EUVD-2023-53729

Malicious code in bioql PyPI...

EUVD-2022-1759

Malicious code in bioql PyPI...

Livechat Chatbot Detected

This is an informational plugin to inform the user that the scanner has detected a publicly accessible Livechat chatbot on the target application. Livechat is a solution to build & deploy AI customer experiences. This detection is included in the AI and LLM category. No source data...

CVE-2024-37405

Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken pre-authentication and livechat:loadHistory...

CVE-2023-49821

Cross-Site Request Forgery CSRF vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15...

CVE-2022-21830

A blind self XSS vulnerability exists in RocketChat LiveChat...

CVE-2024-37405

Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken pre-authentication and livechat:loadHistory...

CVE-2024-37405

Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken pre-authentication and livechat:loadHistory...

CVE-2024-37405

Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken pre-authentication and livechat:loadHistory...

CVE-2024-37405

The CVE-2024-37405 entry concerns Rocket.Chat LiveChat, where two NoSQL injections enable leakage of data: pre-authentication access via livechat:loginByToken and leakage of chat history via livechat:loadHistory. This is a combined, pre-auth scenario affecting the LiveChat component/workflow; the...