CVE-2025-38193

creationtimestamp| type| source ---|---|--- 2026-07-12 22:00:05+00:00| seen| Telegram/umj1CdMieItOpyXE7RZ7QaVSEKWw80YJbSGQfu2ETJpxg 2026-07-13 00:00:16+00:00| published-proof-of-concept| Telegram/umj1CdMieItOpyXE7RZ7QaVSEKWw80YJbSGQfu2ETJpxg...

RHSA-2026:2363

creationtimestamp| type| source ---|---|--- 2026-07-12 22:00:05+00:00| seen| https://t.me/securixykz/1317 2026-07-13 00:00:16+00:00| published-proof-of-concept| https://t.me/securixykz/1317...

GHSA-PHRQ-PC6R-F6GH

creationtimestamp| type| source ---|---|--- 2026-07-12 13:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/87589 2026-07-13 00:00:43+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/87589...

CVE-2020-10567

creationtimestamp| type| source ---|---|--- 2026-07-12 11:00:03+00:00| seen| https://t.me/GithubRedTeam/87991 2026-07-13 00:00:45+00:00| seen| https://t.me/GithubRedTeam/87991...

CVE-2019-10760

creationtimestamp| type| source ---|---|--- 2026-07-12 07:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/88242 2026-07-13 00:00:49+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/88242...

CVE-2024-1065

creationtimestamp| type| source ---|---|--- 2026-07-12 06:00:04+00:00| published-proof-of-concept| https://t.me/cKure/16512 2026-07-12 07:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/88211 2026-07-13 00:00:49+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/882...

EUVD-2026-43131

The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-7620 Notification for Telegram <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_action_set AJAX Action

The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-7620

CVE-2026-7620 affects the WordPress plugin Notification for Telegram (versions up to 3.5.1). The issue is an authorization bypass that allows authenticated attackers with subscriber-level access and above to create, modify, or reschedule the nftb_cron_hook WordPress cron event, enabling unauthori...

CVE-2026-59155

Nezha Monitoring (self-hosted) had a credential exposure flaw prior to version 2.2.5. The GET endpoints /api/v1/ddns and /api/v1/notification returned full resource objects that included plaintext third-party API credentials (Cloudflare API tokens, TencentCloud SecretKeys, Slack/Discord/Telegram ...

Malicious code in stella-coder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c3ed879ef15a68d537ad7b6ddb59508aba58eee49c8ca19b916ef59a0c2da6 stella-cli/telegram-bot.mjs hardcodes a Telegram bot API token BOTTOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2ebSi0" that is controlled by the...

MAL-2026-10134 Malicious code in stella-coder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c3ed879ef15a68d537ad7b6ddb59508aba58eee49c8ca19b916ef59a0c2da6 stella-cli/telegram-bot.mjs hardcodes a Telegram bot API token BOTTOKEN = "8923551485:AAFw4wG8ZwOtp5rzFsnguxhu4AH-2ebSi0" that is controlled by the...

MAL-2026-10119 Malicious code in sankislayer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 74a2d321c0a35b52bc8ba63b8c13dd8e883d63419ed8aa304b648d3599f98ad8 Obfuscated code provides a Telegram bot to join a spamming botnet. Centrally controlled bots can be used to spam other Telegram channels via looped posting,...

CVE-2026-15298

The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for...

CVE-2026-15298

The TelSender WordPress plugin (

CVE-2026-15298 TelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title

The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for...

EUVD-2026-42805

The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for...

CVE-2026-15298

The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for...

CVE-2021-28133

creationtimestamp| type| source ---|---|--- 2026-07-09 23:00:03+00:00| seen| Telegram/faoHppRwIlCS4bU-FDor3oyE0-orUb1-sGk1UcKelvuA 2026-07-10 00:00:10+00:00| seen| Telegram/faoHppRwIlCS4bU-FDor3oyE0-orUb1-sGk1UcKelvuA 2026-07-11 09:00:05+00:00| seen|...

CVE-2025-4798

creationtimestamp| type| source ---|---|--- 2026-07-09 04:00:07+00:00| seen| https://t.me/brutsecurity/2000 2026-07-10 00:00:31+00:00| seen| https://t.me/brutsecurity/2000 2026-07-11 12:00:03+00:00| seen| https://t.me/brutsecurity/2000 2026-07-12 00:00:49+00:00| seen| https://t.me/brutsecurity/20...