CVE-2026-108756: Missing Authorization

Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,...

reconpal

ReconPal: Sfruttare la NLP per la Sicurezza Informatica La fase di ricognizione è una delle più importanti, apparentemente semplice ma che richiede molto impegno e abilità per essere eseguita correttamente. Bisogna conoscere gli strumenti giusti, le query/sintassi corrette, eseguire quelle query,...

MAL-2026-17713 Malicious code in sharpnes (crates.io)

sharpnes is a malicious crate published to crates.io on 2026-10-09 by the account crows7781-glitch versions 0.1.0 and 0.1.1, described only as "The sharpnes project is a learn.". It is an infostealer that exfiltrates data to attacker-controlled Telegram bots when the exported async function...

Malicious code in sharpnes (crates.io)

sharpnes is a malicious crate published to crates.io on 2026-10-09 by the account crows7781-glitch versions 0.1.0 and 0.1.1, described only as "The sharpnes project is a learn.". It is an infostealer that exfiltrates data to attacker-controlled Telegram bots when the exported async function...

The Man Behind a West Bank Telegram Channel Trying to Keep Palestinian Drivers Safe

With no accurate Big Tech mapping app to help him, Anas Hattab launched a Telegram group to get himself home at night. Now nearly 350,000 Palestinians rely on it to navigate the occupied West Bank...

Linux Distros Unpatched Vulnerability : CVE-2026-107181

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via...

CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

DEBIAN-CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

UBUNTU-CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181 Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181 Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181 Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181

Telegram Desktop versions before 7.2.9 are vulnerable to an IPC record-separator injection in Core::Sandbox . This flaw allows remote attackers to inject OPEN: records by using crafted tg:// links containing unescaped semicolons. Exploitation can lead to reaching the interpret: scheme handler, en...

EUVD-2026-94329

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

PT-2026-107506

Name of the Vulnerable Software and Affected Versions Telegram Desktop versions prior to 7.2.9 Description An IPC record-separator injection flaw exists in Core::Sandbox due to the failure to escape semicolons used as command separators when passing tg:// links to a running instance over a local...

CVE-2026-107181: Improper Neutralization of Record Delimiters

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

MAL-2026-17422 Malicious code in shortneer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4960c121d2fbf6337d33df0c6a304f4f3e968d18c64614c323ac5f8389020bab The package ships a macOS arm64 Rust-compiled Python extension core.abi3.so fronted by a thin wrapper lb.py. The only exposed Python function,...

Malicious code in shortneer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4960c121d2fbf6337d33df0c6a304f4f3e968d18c64614c323ac5f8389020bab The package ships a macOS arm64 Rust-compiled Python extension core.abi3.so fronted by a thin wrapper lb.py. The only exposed Python function,...