UBUNTU-CVE-2026-111105

Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

CVE-2026-111105

Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

PT-2026-116160

Name of the Vulnerable Software and Affected Versions OpenHuman versions prior to 0.56.0 Description Cross-site request forgery is possible via the unauthenticated GET '/auth/telegram' loopback callback. The telegram auth handler function processes an attacker-supplied one-time Telegram login tok...

CVE-2026-111105

Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

CVE-2026-111105

The rlottie library used in Telegram is vulnerable to a Remote Code Execution (RCE) flaw caused by a numeric truncation error (CWE-197) . Due to insufficient validation of user-supplied data, the flaw can lead to a write before the start of an allocated buffer . A remote attacker can exploit this...

CVE-2026-111105 Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability

Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

EUVD-2026-102227

Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

CVE-2026-111105 Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability

Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

PT-2026-115086

Name of the Vulnerable Software and Affected Versions Telegram affected versions not specified Description A numeric truncation issue exists within the rlottie library used by Telegram. The flaw stems from improper validation of user-supplied data, which can lead to a write operation occurring...

CVE-2026-111105: Numeric Truncation Error

Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a...

(0Day) Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the rlottie library. The...

CVE-2026-110768

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,...

CVE-2026-110768 holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,...

EUVD-2026-101568

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,...

CVE-2026-110768

Versions of holaOS through 2026.822.1 are vulnerable to an authorization bypass in the channel-gateway Telegram connector . The flaw exists because the connector authorizes senders based on mutable usernames instead of using unique numeric IDs. An attacker can register a released username that is...

PT-2026-114132

Name of the Vulnerable Software and Affected Versions holaOS versions prior to 2026.822.2 Description An authorization bypass exists in the channel-gateway Telegram connector. The system authorizes senders using a mutable username instead of relying solely on the numeric id. An attacker can...

CVE-2026-110768: Authentication Bypass by Spoofing

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,...

MAL-2026-17862 Malicious code in fontcase (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9e2c4992e5295f2b094f3c7c2b2e6c2dbc8d0d9ca6242d58318e6e1b83a4255c During import, the package downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

CVE-2026-109426

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than...

CVE-2026-109427

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encodestring/decodestring functions. Attackers can craft or enumerate...