CVE-2026-61840

Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...

EUVD-2026-114279

Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...

CVE-2026-61840

The Quest Bot Discord bot (prior to version 1.1.9 ) is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the image to GIF command. The root cause is a DNS rebinding vulnerability where the request helper validates a hostname's public IP but performs a second DNS lookup for the actual req...

CVE-2026-61840 Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services

Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...

CVE-2026-61840 Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services

Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...

CVE-2026-61840: vantern-org questbot: Quest Bot is an opensource Discord Bot

Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the image to GIF command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a second DNS lookup. An attacker controlling a domain can return a public address during...

CVE-2026-49347

Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the...

CVE-2026-47196

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the automod add command trims user input but does not reject an empty result. Adding a rule containing only whitespace stores an empty word. The message listener later checks content.includes"", which is always true, causing the bot ...

CVE-2026-47197

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above them in the Discord role hierarchy, as long as the bot itself outranks the target. This bypasses Discord’s normal role hierarchy protections...

CVE-2026-48485

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, unbanning, unwarning, kicking, muting, and unmuting, but stored warning reasons are still printed by /warns without mention suppression. A moderator can create a warning with...

CVE-2026-49347

CVE-2026-49347 affects Quest Bot (Discord bot). Before v1.1.8, any user who can access the ticket panel could repeatedly create new ticket channels; the system did not enforce a per-user open-ticket limit or cooldown. The issue persists in that the latest release still creates a new database tick...

CVE-2026-49347 Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown

Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the...

CVE-2026-49347

Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the...

CVE-2026-49347 Quest Bot: Ticket creation has no per-user open-ticket limit or cooldown

Quest Bot is an opensource Discord Bot. Prior to version 1.1.8, any user who can access the ticket panel can repeatedly create new ticket channels. The latest release still creates a new database ticket and Discord channel for every completed ticket modal submission, without checking whether the...

CVE-2026-48485 Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, unbanning, unwarning, kicking, muting, and unmuting, but stored warning reasons are still printed by /warns without mention suppression. A moderator can create a warning with...

CVE-2026-48485 Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, unbanning, unwarning, kicking, muting, and unmuting, but stored warning reasons are still printed by /warns without mention suppression. A moderator can create a warning with...

CVE-2026-48485

The CVE-2026-48485 affects Quest Bot (Discord bot). Before version 1.1.6, the bot suppressed mentions when actions like creating a warning occurred, but stored warning reasons can still be printed by /warns, potentially triggering a mass ping if the bot has permission. The root cause is that stor...

CVE-2026-48485 Quest Bot: Stored warn reasons can still trigger bot-powered mass mentions through `/warns`.

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, unbanning, unwarning, kicking, muting, and unmuting, but stored warning reasons are still printed by /warns without mention suppression. A moderator can create a warning with...

CVE-2026-48485

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentions when creating, unbanning, unwarning, kicking, muting, and unmuting, but stored warning reasons are still printed by /warns without mention suppression. A moderator can create a warning with...

CVE-2026-47197

CVE-2026-47197 concerns the Quest Bot for Discord. Before version 1.1.6, a moderator who has the relevant Discord permission can use the bot to moderate users who are higher in the Discord role hierarchy, provided the bot itself outranks the target. This bypasses Discord’s normal role hierarchy p...