CVE-2026-30655

creationtimestamp| type| source ---|---|--- 2026-03-24 02:00:04+00:00| seen| https://t.me/GithubRedTeam/76903 2026-08-27 15:00:11+00:00| seen| https://t.me/cve0day/303 2026-08-28 00:00:41+00:00| seen| https://t.me/cve0day/303 2026-08-29 00:00:30+00:00| published-proof-of-concept|...

CVE-2026-30498

creationtimestamp| type| source ---|---|--- 2026-03-23 18:00:04+00:00| seen| https://t.me/GithubRedTeam/76860...

CVE-2026-33693

creationtimestamp| type| source ---|---|--- 2026-03-23 15:39:21+00:00| published-proof-of-concept| https://github.com/LemmyNet/lemmy/security/advisories/GHSA-q537-8fr5-cw35 2026-03-23 23:02:30+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/76888...

Malicious code in hash-utils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4177b7c46ecbfa35116b35a2a491107d0514cd6551a447b7213ef6e097172939 During importing the module, the code attempts to exfiltrate sensitive Telegram's client session files. --- Category: MALICIOUS - The campaign has clearly...

MAL-2026-2118 Malicious code in hash-utils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4177b7c46ecbfa35116b35a2a491107d0514cd6551a447b7213ef6e097172939 During importing the module, the code attempts to exfiltrate sensitive Telegram's client session files. --- Category: MALICIOUS - The campaign has clearly...

WordPress WP Telegram Widget and Join Link plugin <= 2.2.13 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by johska in WordPress Plugin WP Telegram Widget and Join Link versions = 2.2.13...

CVE-2026-24516

creationtimestamp| type| source ---|---|--- 2026-03-22 21:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/76685 2026-04-03 09:00:05+00:00| published-proof-of-concept| Telegram/iJe41NTkZQJK4wFVG9OP9y2V0JVLEcjlDCmGEFn1YNc-zvI 2026-09-11 07:10:17+00:00| seen|...

CVE-2026-33622

creationtimestamp| type| source ---|---|--- 2026-03-22 00:47:51+00:00| published-proof-of-concept| https://github.com/pinchtab/pinchtab/security/advisories/GHSA-w5pc-m664-r62v 2026-03-31 17:24:25+00:00| published-proof-of-concept| Telegram/WxHgPFElWYDoFBGl3K0BVKfspuGbiR8geCdPJnxqtoWdxxM...

CVE-2025-5391

creationtimestamp| type| source ---|---|--- 2026-03-19 04:02:40+00:00| published-proof-of-concept| https://t.me/liwaamohammad/5085...

CVE-2026-33320

creationtimestamp| type| source ---|---|--- 2026-03-18 19:16:52+00:00| published-proof-of-concept| https://github.com/TomWright/dasel/security/advisories/GHSA-4fcp-jxh7-23x8 2026-05-04 21:00:04+00:00| seen| Telegram/rPnY3cDOMvKcPFRcx6QsxUGiZwWHKwUb91xptawBtUQTSW0 2026-06-01 21:00:04+00:00| seen|...

CVE-2026-32290

creationtimestamp| type| source ---|---|--- 2026-03-18 17:04:14+00:00| seen| https://t.me/truesecator/8008...

GHSA-JQ3F-VJWW-8RQ7 OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion

Summary openclaw versions = 2026.3.12 read and buffered Telegram webhook request bodies before validating x-telegram-bot-api-secret-token. This let unauthenticated callers force up to the configured webhook body limit of pre-auth body I/O and JSON parse work per request. Affected Packages /...

Allocation of Resources Without Limits or Throttling

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Telegram webhook request handling process. An attacker can cause excessive resource consumption by sending unauthenticated...

OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion

Summary openclaw versions = 2026.3.12 read and buffered Telegram webhook request bodies before validating x-telegram-bot-api-secret-token. This let unauthenticated callers force up to the configured webhook body limit of pre-auth body I/O and JSON parse work per request. Affected Packages /...

Insertion of Sensitive Information into Log File

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the fetchRemoteMedia function. An attacker can obtain sensitive bot tokens by triggering Telegram media fetch errors that cause the...

OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs

Summary openclaw versions /..., so the resulting error strings could leak bot tokens into logs, console output, or any downstream error surface that rendered the exception text. This issue is in scope under OpenClaw's trust model because the leaked secret is an OpenClaw-operated integration...

GHSA-XWCJ-HWHF-H378 OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs

Summary openclaw versions /..., so the resulting error strings could leak bot tokens into logs, console output, or any downstream error surface that rendered the exception text. This issue is in scope under OpenClaw's trust model because the leaked secret is an OpenClaw-operated integration...

Models Are Applying to Be the Face of AI Scams

Dozens of Telegram channels reviewed by WIRED include job listings for “AI face models.” The mostly women who land these gigs are likely being used to dupe victims out of their money...

Malicious code in fastapi-middleware-cors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 305178589615e2247b892b3e305e5fd69a0fc02092f0b115b6b384441f5ddd46 Library disguised as FastAPI helper is executing obfuscated code during importing the module. The code is highly obfuscated; the code seems to contain an...

MAL-2026-1422 Malicious code in fastapi-middleware-cors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 305178589615e2247b892b3e305e5fd69a0fc02092f0b115b6b384441f5ddd46 Library disguised as FastAPI helper is executing obfuscated code during importing the module. The code is highly obfuscated; the code seems to contain an...