88117 matches found
CVE-2026-73031
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw...
EUVD-2026-56889
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw...
CVE-2026-73031 telegram-search Stored XSS via v-html in MessageList.vue
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw...
CVE-2026-73031 telegram-search Stored XSS via v-html in MessageList.vue
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw...
CVE-2026-73031
Telegram-search is affected by a stored XSS in MessageList.vue, where the highlightKeyword function passes raw message content to v-html without escaping. This allows an attacker to craft HTML-bearing messages in a shared Telegram group, enabling stored, cross-user JavaScript execution when users...
CVE-2026-44401
creationtimestamp| type| source ---|---|--- 2026-08-11 12:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97555 2026-08-12 00:00:08+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97555 2026-08-12 08:00:04+00:00| published-proof-of-concept|...
CVE-2026-73031: Improper Neutralization of Input During Web Page Generation
telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw...
PT-2026-70873
Name of the Vulnerable Software and Affected Versions telegram-search affected versions not specified Description A stored cross-site scripting issue exists that allows remote attackers to execute arbitrary JavaScript in the browsers of other users. This occurs when crafted messages containing...
GHSA-CWH8-W64C-4J5H
creationtimestamp| type| source ---|---|--- 2026-08-10 14:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97436 2026-08-11 00:00:07+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97436...
Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...
Malicious code in btcflx (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839c411e8d33badaebd5e59b2d966dc000e631843a49ce9352caafd1b7dd9e12 Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet director...
MAL-2026-13682 Malicious code in btcflx (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839c411e8d33badaebd5e59b2d966dc000e631843a49ce9352caafd1b7dd9e12 Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet director...
MAL-2026-13681 Malicious code in btcflip (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4271f738e49ead6113a249ca949232cad9664db210319a097b56385b1942970 The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory C:\Users\Documents\Monero on...
Malicious code in btcflip (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4271f738e49ead6113a249ca949232cad9664db210319a097b56385b1942970 The package advertises itself as an HTTP speed-up library, but on import it archives the user's Monero wallet directory C:\Users\Documents\Monero on...
MAL-2026-13683 Malicious code in kotoraka (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6 On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory Windows: C:\Users\Documents\Monero;...
Malicious code in kotoraka (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6 On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory Windows: C:\Users\Documents\Monero;...
Malicious code in hex-encode-utils (npm)
hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...
MAL-2026-13667 Malicious code in kotanku (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2281ff1cf735f26084f13f5f3ef5e1d5f9faf8cf06254532e5ee6d27204f52d1 During import, the package exfiltrates cryptocurrency wallet files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...
Malicious code in kotanku (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2281ff1cf735f26084f13f5f3ef5e1d5f9faf8cf06254532e5ee6d27204f52d1 During import, the package exfiltrates cryptocurrency wallet files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...
CVE-2021-30109
creationtimestamp| type| source ---|---|--- 2026-08-09 19:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97335 2026-08-10 00:00:08+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97335...