EUVD-2026-63806

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...

CVE-2026-65644

CVE-2026-65644 is a stored XSS in Rocket.Chat's Omnichannel livechat visitor name field, rendered via dangerouslySetInnerHTML in InquireSidePanelItem.tsx, allowing unauthenticated attackers to inject clickable links into agent views. Patch PR #41595 fixes it in versions 7.10.15 and 8.1.8+. Exploi...

PT-2026-79291

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...