CVE-2026-93528

creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:04+00:00| published-proof-of-concept| Telegram/dT7yXvodNHrxcxQnkvpfsJjdaGRQYlSk9Plw9VoLoilrXc 2026-09-23 00:00:28+00:00| published-proof-of-concept| Telegram/dT7yXvodNHrxcxQnkvpfsJjdaGRQYlSk9Plw9VoLoilrXc...

CVE-2026-93674

creationtimestamp| type| source ---|---|--- 2026-09-22 03:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102990 2026-09-22 15:00:07+00:00| seen| Telegram/tRGJvhGulvE60BKtV9RMDKpw0AGHjXygS1hBVz2YWgBcAA 2026-09-22 15:00:07+00:00| published-proof-of-concept|...

CVE-2026-93680

creationtimestamp| type| source ---|---|--- 2026-09-22 03:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102985 2026-09-22 07:00:04+00:00| published-proof-of-concept| Telegram/vyIeo1Zc9XylBexdsiTomPffV682Wt6mgpuKtfL99P5mYic 2026-09-22 15:00:07+00:00| seen|...

CVE-2026-91097

creationtimestamp| type| source ---|---|--- 2026-09-21 21:00:04+00:00| seen| https://t.me/GithubRedTeam/102976 2026-09-22 00:00:09+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102976 2026-09-22 06:00:04+00:00| seen| https://t.me/GithubRedTeam/102995 2026-09-22 07:00:04+00:00|...

CVE-2026-94488

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...

CVE-2026-94488

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...

CVE-2026-94488

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...

EUVD-2026-84030

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...

CVE-2026-94488

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...

CVE-2026-94488

Telegram Desktop versions prior to 6.9.4 are vulnerable to Cross-Site Scripting (XSS) within the HTML exporter. The root cause is located in the button.text.toUtf8 function in export_output_html.cpp. For exploitation to occur, a victim must actively use the HTML export feature; however, an exploi...

CVE-2026-44236

creationtimestamp| type| source ---|---|--- 2026-09-21 15:00:03+00:00| seen| https://t.me/bdufstecru/3470 2026-09-22 00:00:09+00:00| published-proof-of-concept| https://t.me/bdufstecru/3470...

CVE-2026-56942

creationtimestamp| type| source ---|---|--- 2026-09-21 10:00:04+00:00| published-proof-of-concept| https://t.me/orderofsixangles/3196 2026-09-21 10:00:04+00:00| published-proof-of-concept| https://t.me/poxek/6330 2026-09-22 00:00:10+00:00| published-proof-of-concept|...

MAL-2026-16326 Malicious code in byted-commerce-materials (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collec...

CVE-2026-94488: Improper Neutralization of Input During Web Page Generation

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...

PT-2026-96192

Name of the Vulnerable Software and Affected Versions Telegram Desktop versions prior to 7.0.1 Description Cross-site scripting XSS is possible within the HTML exporter. This issue occurs in the button.text.toUtf8 function located in export output html.cpp. Exploitation requires the victim to use...

CVE-2016-10204

creationtimestamp| type| source ---|---|--- 2026-09-20 22:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102910 2026-09-21 00:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102910 2026-09-22 07:00:05+00:00| seen|...

Malicious code in @siriusbeyond/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695 Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install...

MAL-2026-16345 Malicious code in starbucks-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f42de3e225b6f8d6be04fbf613ae4d17458626c92f2cfe1bf1b4476fe132e761 The package's package.json declares a preinstall script that runs callback.js on npm install. callback.js collects os.hostname, os.userInfo,...

CVE-2026-75863

creationtimestamp| type| source ---|---|--- 2026-09-19 18:00:04+00:00| published-proof-of-concept| Telegram/4he6Q-7YfGmpgRRUhxEQm-N1-KtSWKTxYEshkl6Xmi0RZck 2026-09-20 00:00:07+00:00| published-proof-of-concept| Telegram/4he6Q-7YfGmpgRRUhxEQm-N1-KtSWKTxYEshkl6Xmi0RZck 2026-09-25 09:17:25+00:00|...

CVE-2026-75157

creationtimestamp| type| source ---|---|--- 2026-09-19 14:00:05+00:00| seen| https://t.me/GithubRedTeam/102754 2026-09-20 00:00:07+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102754 2026-09-22 07:00:10+00:00| seen| Telegram/iGFXEv4gfpyl7BqTNjPDtEQ8FnW4XXXDcMjUEMDNy6ylNI 2026-09-...