CVE-2026-39966

TypeBot is a chatbot builder tool. In versions 3.15.2, the getLinkedTypebots API endpoint returns full bot definitions to any authenticated user who references a target bot ID in a Typebot Link block, regardless of workspace ownership, leading to IDOR. The authorization check uses Array.filter wi...

CVE-2026-39964

TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer packages/embeds/js renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser...

CVE-2026-39970

The CVE covers TypeBot (chatbot builder) ≤ version 3.15.2, where the profile picture upload form fails to sanitize SVG/XML uploads and directly renders them. This enables stored XSS via crafted SVGs containing JavaScript, with payload stored on app.typebot.io and accessible via a permanent link, ...

CVE-2026-9277

creationtimestamp| type| source ---|---|--- 2026-05-22 17:34:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhhsrhmds2o 2026-05-23 05:06:18+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mmiohjvizp24...

CVE-2026-39964

TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer packages/embeds/js renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser...

CVE-2026-7325

creationtimestamp| type| source ---|---|--- 2026-05-22 17:13:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhgn63lvp2q...

CVE-2026-9246

creationtimestamp| type| source ---|---|--- 2026-05-22 16:57:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhfptu6za2t...

CVE-2026-9248

creationtimestamp| type| source ---|---|--- 2026-05-22 16:54:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhfkht5tm2n...

CVE-2026-9047

creationtimestamp| type| source ---|---|--- 2026-05-22 16:46:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhf4xkwxt2n 2026-06-06 11:02:52+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mnmivyhkac2z...

CVE-2026-25680

creationtimestamp| type| source ---|---|--- 2026-05-22 16:40:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhes65b3m2q...

CVE-2026-9245

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : Devolutions Server 2026.1.6.0 through 2026.1.16.0 Devolutions...

CVE-2026-9245

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : Devolutions Server 2026.1.6.0 through 2026.1.16.0 Devolutions...

CVE-2026-7636

creationtimestamp| type| source ---|---|--- 2026-05-22 13:28:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmh22tl3u52n...

CVE-2026-43220

creationtimestamp| type| source ---|---|--- 2026-05-22 13:05:30+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmgyri3mmq2x...

CVE-2026-31499

creationtimestamp| type| source ---|---|--- 2026-05-22 13:05:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmgyri3mmq2x...

CVE-2026-3473

creationtimestamp| type| source ---|---|--- 2026-05-22 12:49:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgxuvf5my2h...

CVE-2026-5308

creationtimestamp| type| source ---|---|--- 2026-05-22 12:43:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgxkrnsjj2k...

CVE-2026-6864

creationtimestamp| type| source ---|---|--- 2026-05-22 07:13:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgf3hprox2k 2026-05-25 05:49:15+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmnrs6gp4q2l...

CVE-2026-7509

creationtimestamp| type| source ---|---|--- 2026-05-22 06:58:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgeamfjm22k 2026-05-25 04:25:55+00:00| seen| https://bsky.app/profile/donwebmedia.bsky.social/post/3mmnn56cp2o2s...

CVE-2026-9104

creationtimestamp| type| source ---|---|--- 2026-05-22 06:53:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmgdxnw2x32k...