CVE-2026-55543

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive...

CVE-2026-55543 TuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` file

TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive...

CVE-2026-55543

Versions of TuxGuitar prior to 2.1.0 are vulnerable to Arbitrary Code Execution when processing a maliciously crafted .tg file. An attacker can set the gervil.soundbank.path property to point to an on-disk archive (such as the .tg file itself) containing a META-INF/services/javax.sound.midi.Sound...

Linux Distros Unpatched Vulnerability : CVE-2026-107181

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via...

CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

DEBIAN-CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

UBUNTU-CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

EUVD-2026-94329

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181 Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181 Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181 Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

CVE-2026-107181

Telegram Desktop versions before 7.2.9 are vulnerable to an IPC record-separator injection in Core::Sandbox . This flaw allows remote attackers to inject OPEN: records by using crafted tg:// links containing unescaped semicolons. Exploitation can lead to reaching the interpret: scheme handler, en...

PT-2026-107506

Name of the Vulnerable Software and Affected Versions Telegram Desktop versions prior to 7.2.9 Description An IPC record-separator injection flaw exists in Core::Sandbox due to the failure to escape semicolons used as command separators when passing tg:// links to a running instance over a local...

CVE-2026-107181: Improper Neutralization of Record Delimiters

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

tg-autoposter (>=3.2.0, <=3.4.0b2) potentially affected by CVE-2026-92164 via streamlink (4.3.0)

streamlink PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter =3.2.0, =3.4.0b2 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

offstream (>=1.0.0, <=1.0.2), tg-autoposter (>=2.4.0, <=2.4.1) potentially affected by CVE-2026-92164 via streamlink (3.0.3)

streamlink PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - offstream =1.0.0, =2.4.0, =2.4.1 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

tg-autoposter (2.1.0) potentially affected by CVE-2026-92164 via streamlink (1.5.0)

streamlink PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 2.1.0 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...

tg-autoposter (2.4.3) potentially affected by CVE-2026-92164 via streamlink (4.0.0)

streamlink PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 2.4.3 Source cves: CVE-2026-92164 Source advisory: OSV:PYSEC-2026-4172...