PT-2026-83999

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

PT-2026-83669

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash ai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content...

Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-028 (ALASTOMCAT9-2026-028)

The version of tomcat installed on the remote host is prior to 9.0.121-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2026-028 advisory. Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat:...

CVE-2026-79483

FastGPT Community Edition versions 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection flaw in the POST /api/core/chat/getHistories endpoint. The root cause is that the authOutLinkInit() function fails to perform proper runtime type checks, allowing an unauthenticated attacker to inject mal...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

CVE-2026-82281

Kotaemon through 0.12.0 fails to properly validate conversation ownership in selectconv, deleteconv, renameconv, and onsetpublicconversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation...

CVE-2026-82284

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-58616

Concurrent execution using shared resource with improper synchronization 'race condition' in Copilot Chat Microsoft Edge allows an authorized attacker to disclose information over a network...

Microsoft Teams Has Become a Haven for Scammers in China

Fraudsters are exploiting enterprise chat apps like Teams and Webex to trick Chinese victims into transferring large sums of money, fueling a wave of complaints...

EUVD-2026-67847

Concurrent execution using shared resource with improper synchronization 'race condition' in Copilot Chat Microsoft Edge allows an authorized attacker to disclose information over a network...

CVE-2026-58616 Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

...

CVE-2026-58616 Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

...

CVE-2026-58616

CVE-2026-58616 is a race condition (improper synchronization of a shared resource) in Copilot Chat within Microsoft Edge , rated CVSS 4.4 (Medium) . An authorized attacker with low privileges can trigger a network-based information disclosure , requiring user interaction and exhibiting changed sc...

CVE-2026-82284 Quivr Chat Endpoints Missing Ownership Validation

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-82284

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

EUVD-2026-67815

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-82284

Quivr versions through 0.0.322 contain a missing ownership validation flaw in three chat API endpoints: GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/answer. An authenticated attacker can leverage this to read other users' conversation histories (including...

CVE-2026-82284 Quivr Chat Endpoints Missing Ownership Validation

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...