PT-2026-98395

Name of the Vulnerable Software and Affected Versions wpForo Forum versions prior to 3.1.7 Description Stored Cross-Site Scripting occurs via the 'telegram' profile field due to insufficient input sanitization and output escaping in the profile update action. The raw $ POST'data' array is copied...

A Bulletproof Business? Towards Detecting Infrastructure-As-A-Service Offerings on Telegram

Cybercriminal operations increasingly depend on reusable digital infrastructure---including hosting, proxies, and virtual private networks VPNs---rented through Cybercrime-as-a-Service markets and advertised on platforms such as Telegram. We present a taxonomy for identifying Telegram messages...

CVE-2026-92207

creationtimestamp| type| source ---|---|--- 2026-09-22 12:00:04+00:00| seen| Telegram/KvW7Hl1Cqo7eJ8unUH7ExEoxLocT3acDP5ceHE1iQDeOBQQ 2026-09-23 00:00:10+00:00| published-proof-of-concept| Telegram/KvW7Hl1Cqo7eJ8unUH7ExEoxLocT3acDP5ceHE1iQDeOBQQ 2026-09-25 09:21:48+00:00| seen|...

CVE-2026-84235

creationtimestamp| type| source ---|---|--- 2026-09-22 09:00:04+00:00| seen| https://t.me/ViralCyber/26321 2026-09-23 00:00:24+00:00| seen| https://t.me/ViralCyber/26321...

CVE-2024-31508

creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:10+00:00| seen| Telegram/6b-rkbWXWakDcg0xMKZrOjk11Dq6lI735beDpEcqG6K42dE 2026-09-23 00:00:12+00:00| published-proof-of-concept| Telegram/6b-rkbWXWakDcg0xMKZrOjk11Dq6lI735beDpEcqG6K42dE...

CVE-2020-36079

creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:10+00:00| seen| Telegram/ZCdi5I9p-Xc5z40zki51FeiOFOjVkkHbDLVUITujH0 2026-09-23 00:00:11+00:00| published-proof-of-concept| Telegram/ZCdi5I9p-Xc5z40zki51FeiOFOjVkkHbDLVUITujH0...

CVE-2024-31218

creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:07+00:00| seen| Telegram/eINIBlc80g12HhUDNogYmyVwNeGM-NxIjflQ5MfYkTLG7EA 2026-09-23 00:00:14+00:00| published-proof-of-concept| Telegram/eINIBlc80g12HhUDNogYmyVwNeGM-NxIjflQ5MfYkTLG7EA...

CVE-2026-85721

creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:07+00:00| seen| Telegram/5yYcJ8KxvxPc2wm8yAMZr4IlCiIPgBAjiTQuvArbIBOcZs 2026-09-23 00:00:14+00:00| published-proof-of-concept| Telegram/5yYcJ8KxvxPc2wm8yAMZr4IlCiIPgBAjiTQuvArbIBOcZs...

CVE-2026-86554

creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:06+00:00| seen| Telegram/F-nhc0ijtr3NaromnbizNbgs7TOvAKcStOoCvZVO5zQFtg 2026-09-23 00:00:25+00:00| published-proof-of-concept| Telegram/F-nhc0ijtr3NaromnbizNbgs7TOvAKcStOoCvZVO5zQFtg 2026-09-23 17:30:06+00:00| seen|...

CVE-2026-66752

creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:05+00:00| seen| Telegram/nMUaw2zZXyCly-Bqsn7kRIsLFdlVwXx5RzNb6RunyMxeZuU 2026-09-23 00:00:25+00:00| published-proof-of-concept| Telegram/nMUaw2zZXyCly-Bqsn7kRIsLFdlVwXx5RzNb6RunyMxeZuU...

CVE-2020-8004

creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:04+00:00| seen| Telegram/D3opvBxKExsMH788uhnUS8fKp1fWiEpUE81jmA0i0W9lTM 2026-09-23 00:00:25+00:00| published-proof-of-concept| Telegram/D3opvBxKExsMH788uhnUS8fKp1fWiEpUE81jmA0i0W9lTM...

CVE-2026-93528

creationtimestamp| type| source ---|---|--- 2026-09-22 07:00:04+00:00| published-proof-of-concept| Telegram/dT7yXvodNHrxcxQnkvpfsJjdaGRQYlSk9Plw9VoLoilrXc 2026-09-23 00:00:28+00:00| published-proof-of-concept| Telegram/dT7yXvodNHrxcxQnkvpfsJjdaGRQYlSk9Plw9VoLoilrXc...

CVE-2026-93674

creationtimestamp| type| source ---|---|--- 2026-09-22 03:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102990 2026-09-22 15:00:07+00:00| seen| Telegram/tRGJvhGulvE60BKtV9RMDKpw0AGHjXygS1hBVz2YWgBcAA 2026-09-22 15:00:07+00:00| published-proof-of-concept|...

CVE-2026-93680

creationtimestamp| type| source ---|---|--- 2026-09-22 03:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102985 2026-09-22 07:00:04+00:00| published-proof-of-concept| Telegram/vyIeo1Zc9XylBexdsiTomPffV682Wt6mgpuKtfL99P5mYic 2026-09-22 15:00:07+00:00| seen|...

CVE-2026-91097

creationtimestamp| type| source ---|---|--- 2026-09-21 21:00:04+00:00| seen| https://t.me/GithubRedTeam/102976 2026-09-22 00:00:09+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102976 2026-09-22 06:00:04+00:00| seen| https://t.me/GithubRedTeam/102995 2026-09-22 07:00:04+00:00|...

CVE-2026-94488

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...

DEBIAN-CVE-2026-94488

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...

CVE-2026-94488

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...

CVE-2026-94488

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...

EUVD-2026-84030

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...