88288 matches found
CVE-2026-94488
Telegram Desktop versions prior to 6.9.4 are vulnerable to Cross-Site Scripting (XSS) within the HTML exporter. The root cause is located in the button.text.toUtf8 function in export_output_html.cpp. For exploitation to occur, a victim must actively use the HTML export feature; however, an exploi...
CVE-2026-94488
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...
GHSA-88QP-4G94-3RF3
creationtimestamp| type| source ---|---|--- 2026-09-21 15:00:03+00:00| seen| https://t.me/bdufstecru/3472 2026-09-22 00:00:09+00:00| published-proof-of-concept| https://t.me/bdufstecru/3472...
CVE-2026-44236
creationtimestamp| type| source ---|---|--- 2026-09-21 15:00:03+00:00| seen| https://t.me/bdufstecru/3470 2026-09-22 00:00:09+00:00| published-proof-of-concept| https://t.me/bdufstecru/3470...
CVE-2026-56942
creationtimestamp| type| source ---|---|--- 2026-09-21 10:00:04+00:00| published-proof-of-concept| https://t.me/orderofsixangles/3196 2026-09-21 10:00:04+00:00| published-proof-of-concept| https://t.me/poxek/6330 2026-09-22 00:00:10+00:00| published-proof-of-concept|...
Malicious code in byted-commerce-materials (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collec...
MAL-2026-16326 Malicious code in byted-commerce-materials (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f777e32b4a6cbb7f91f7fcac050a02a73e356df1c87e7dcd985ea9172a3993da package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collec...
MAL-2026-16343 Malicious code in siriusbeyond (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce19ca17a48cf79dd094940533d1bff88413d44c945948d0041da15a5b61779 package.json wires callback.js to both the preinstall and postinstall lifecycle hooks, so npm install siriusbeyond executes it automatically...
Malicious code in @siriusbeyond/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689 Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects hos...
MAL-2026-16322 Malicious code in @siriusbeyond/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 330b388e1f9ee72c0c2a94cca9e4cc7ff3b525a3f673b324b093286329f60689 Package @siriusbeyond/[email protected] declares both preinstall and postinstall scripts that execute callback.js on npm install. callback.js collects hos...
CVE-2026-94488: Improper Neutralization of Input During Web Page Generation
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. The first fixed stable version is 7.0.1. This occurs in button.text.toUtf8 in exportoutputhtml.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit payload can be exported if a message were...
PT-2026-96192
Name of the Vulnerable Software and Affected Versions Telegram Desktop versions prior to 7.0.1 Description Cross-site scripting XSS is possible within the HTML exporter. This issue occurs in the button.text.toUtf8 function located in export output html.cpp. Exploitation requires the victim to use...
CVE-2016-10204
creationtimestamp| type| source ---|---|--- 2026-09-20 22:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102910 2026-09-21 00:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102910 2026-09-22 07:00:05+00:00| seen|...
Malicious code in @siriusbeyond/auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695 Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install...
MAL-2026-16345 Malicious code in starbucks-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f42de3e225b6f8d6be04fbf613ae4d17458626c92f2cfe1bf1b4476fe132e761 The package's package.json declares a preinstall script that runs callback.js on npm install. callback.js collects os.hostname, os.userInfo,...
CVE-2026-75863
creationtimestamp| type| source ---|---|--- 2026-09-19 18:00:04+00:00| published-proof-of-concept| Telegram/4he6Q-7YfGmpgRRUhxEQm-N1-KtSWKTxYEshkl6Xmi0RZck 2026-09-20 00:00:07+00:00| published-proof-of-concept| Telegram/4he6Q-7YfGmpgRRUhxEQm-N1-KtSWKTxYEshkl6Xmi0RZck 2026-09-25 09:17:25+00:00|...
CVE-2026-75157
creationtimestamp| type| source ---|---|--- 2026-09-19 14:00:05+00:00| seen| https://t.me/GithubRedTeam/102754 2026-09-20 00:00:07+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102754 2026-09-22 07:00:10+00:00| seen| Telegram/iGFXEv4gfpyl7BqTNjPDtEQ8FnW4XXXDcMjUEMDNy6ylNI 2026-09-...
CVE-2026-34492
creationtimestamp| type| source ---|---|--- 2026-09-19 12:00:05+00:00| seen| https://t.me/icscert/1436 2026-09-20 00:00:10+00:00| seen| https://t.me/icscert/1436...
CVE-2026-81988
creationtimestamp| type| source ---|---|--- 2026-09-19 12:00:05+00:00| seen| Telegram/FtCIultLb3jdqKkaMJKZnmj6x9S-dDOfythAjlw0Hwc8 2026-09-20 00:00:10+00:00| published-proof-of-concept| Telegram/FtCIultLb3jdqKkaMJKZnmj6x9S-dDOfythAjlw0Hwc8 2026-09-25 09:17:11+00:00| seen|...