CVE-2018-19629

creationtimestamp| type| source ---|---|--- 2025-12-16 09:00:04+00:00| published-proof-of-concept| Telegram/eipyR0KgNonT7wOL7ZKwmO8kNPLXykuyv2avaPuoPm3xW80...

CVE-2025-68927

creationtimestamp| type| source ---|---|--- 2025-12-15 19:17:13+00:00| published-proof-of-concept| https://github.com/abhinavxd/libredesk/security/advisories/GHSA-wh6m-h6f4-rjf4 2026-01-02 15:08:07+00:00| published-proof-of-concept| Telegram/iY4yZ2PFpGxByFsrgplKVch9nhT5x9DeCvqvBNZo45zgPeM...

CVE-2025-67748

creationtimestamp| type| source ---|---|--- 2025-12-15 18:20:33+00:00| published-proof-of-concept| https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2 2026-01-02 18:47:00+00:00| published-proof-of-concept| Telegram/909Vqfy1t-GN-jmnJRhonTHruzsnwKWBWvcbC9dRm7P3pmc...

Malicious code in smtblib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 15a295f1d98fcbbdd6a077bc3a849966ca3f73919c0d47e58948ff382481e5b6 Malicious copy of a standard library module that during class initialization downloads and executes remote code and after that attempts to cover its tracks by...

MAL-2025-192579 Malicious code in smtblib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 15a295f1d98fcbbdd6a077bc3a849966ca3f73919c0d47e58948ff382481e5b6 Malicious copy of a standard library module that during class initialization downloads and executes remote code and after that attempts to cover its tracks by...

Phantom Stealer Spread by ISO Phishing Emails Hitting Russian Finance Sector

Cybersecurity researchers have disclosed details of an active phishing campaign that's targeting a wide range of sectors in Russia with phishing emails that deliver Phantom Stealer via malicious ISO optical disc images. The activity, codenamed Operation MoneyMount-ISO by Seqrite Labs, has primari...

CVE-2025-66482

creationtimestamp| type| source ---|---|--- 2025-12-13 10:32:43+00:00| published-proof-of-concept| https://github.com/misskey-dev/misskey/security/advisories/GHSA-wwrj-3hvj-prpm 2026-01-06 20:11:53+00:00| published-proof-of-concept| Telegram/mJFISOaG9sdliiq532xrtHTh4hR6RCcMc304VWQpxZ4gXns...

Path Traversal

Pyrofork is vulnerable to Path Traversal. The vulnerability is due to improper sanitization of filenames received from Telegram messages in the downloadmedia method, which allows an attacker to supply a malicious filename via DocumentAttributeFilename and perform path traversal during file path...

CVE-2025-43426

creationtimestamp| type| source ---|---|--- 2025-12-12 21:00:07+00:00| published-proof-of-concept| Telegram/z917lPoY4z2i6pdf0d-zy8JTrnC7jL9Rrjt0jECLqNamFjY 2026-07-21 07:00:05+00:00| seen| https://t.me/novnow/1294032 2026-07-21 07:00:05+00:00| seen| https://t.me/novnow/1294016 2026-07-22...

New Advanced Phishing Kits Use AI and MFA Bypass Tactics to Steal Credentials at Scale

Cybersecurity researchers have documented four new phishing kits named BlackForce, GhostFrame, InboxPrime AI, and Spiderman that are capable of facilitating credential theft at scale. BlackForce, first detected in August 2025, is designed to steal credentials and perform Man-in-the-Browser MitB...

Following the digital trail: what happens to data stolen in a phishing attack

Introduction A typical phishing attack involves a user clicking a fraudulent link and entering their credentials on a scam website. However, the attack is far from over at that point. The moment the confidential information falls into the hands of cybercriminals, it immediately transforms into a...

CVE-2020-0014

creationtimestamp| type| source ---|---|--- 2025-12-12 09:00:05+00:00| published-proof-of-concept| Telegram/EftIdxh0m82pCg23mhioS-smQ0jukHsVEz7My1KFRejYJM...

CVE-2025-67720

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-55816

creationtimestamp| type| source ---|---|--- 2025-12-11 21:00:06+00:00| published-proof-of-concept| Telegram/0R1sh6yTM6RpS889fQ8OVezlutCC6wifTf5dIyVUqSNUZo...

CVE-2025-66470

creationtimestamp| type| source ---|---|--- 2025-12-11 21:00:06+00:00| published-proof-of-concept| Telegram/0R1sh6yTM6RpS889fQ8OVezlutCC6wifTf5dIyVUqSNUZo...

Directory Traversal

Overview pyrofork is a Fork of pyrogram. Elegant, modern and asynchronous Telegram MTProto API framework in Python for users and bots Affected versions of this package are vulnerable to Directory Traversal via the progress' function in the downloadmedia.py file. An attacker can overwrite or creat...

CVE-2025-67720

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...

CVE-2025-67720

CVE-2025-67720 affects Pyrofork, an asynchronous MTProto API framework for Python. The vulnerability occurs in the download_media path when a user-supplied Telegram filename is used to construct the target path without adequate sanitization. Versions 2.3.68 and earlier may fall back to the media’...

CVE-2025-67720 Pyrofork has a Path Traversal in download_media Method

Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the downloadmedia method before using them in file path construction. When downloading media, if the user does not specify a custom filename...