Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,726 results · page 8 of 35
May 28, 2026LiveSmart Video Chat Live Video Chat: Stored Cross-Site ScriptingCVE-2026-9644 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The LiveSmart Video Chat Live Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livesmart_widget' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- LiveSmart Video Chat Live Video Chat
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update LiveSmart Video Chat Live Video Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 28, 2026The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supCVE-2026-32995 · Other software · Rocket.Chat · reported by support@hackerone.comHigh 7.5
The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it directly to translateMessage() without checking Meteor.userId() or verifying room membership. Any authenticated DDP user can read the content of any message by ID from any room (private channels, DMs, E2EE rooms) by calling this method.
- Product
- Rocket.Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
May 27, 2026Firebase Support & Chat Management: Privilege escalationCVE-2026-8787 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth()` function authenticating the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the `acb_firebase_auth` AJAX action, resulting in full account takeover.
- Product
- Firebase Support & Chat Management
- Affected
- up to 3.1.1
- What to do
- Affects up to 3.1.1. Update Firebase Support & Chat Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 26, 2026Lumiverse is a full-featured AI chat application.CVE-2026-44451 · Other software · prolix-oc · reported by GitHubCritical 9.3
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the component override system transpiles user-supplied TSX via Sucrase and evaluates it with new Function, shadowing dangerous globals (fetch, window, eval, etc.) with undefined. A static source validator (validateComponentOverrideSource) additionally blocks these identifiers by word-boundary regex. Both controls are bypassed. String-split bypass of the static validator: any blocked identifier can be reconstructed at runtime from string fragments ('ownerDoc' + 'ument'). DOM ref escape from the sandbox: useRef and useEffect are provided in scope. A ref attached to a rendered element gives a live DOM node. From any real DOM node, node['ownerDoc'+'ument']['def'+'aultView'] yields the real window, bypassing all identifier shadows. Theme packs (.lumitheme / .lumiverse-theme) are the shareable delivery mechanism. A malicious pack is an exploit path: the victim imports the file, enables one component override in the Theme Editor, and the payload fires in their authenticated session.This vulnerability is fixed in 0.9.7.
- Product
- Lumiverse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lumiverse is a full-featured AI chat application.CVE-2026-44450 · Other software · prolix-oc · reported by GitHubCritical 9.9
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command field against an allowlist of binary names but forwards the args array to the child process without any validation. Every binary on the allowlist accepts an inline-code execution flag (-e for node/bun, -c for python3/deno), giving any logged-in user arbitrary OS-level code execution on the Lumiverse server. The route requires only requireAuth (not requireOwner). The server binds on all interfaces (::) and the host-header rebinding check is bypassed trivially by any HTTP client that sends Host: localhost:<port> directly, making this exploitable from any machine with network access to the server port. This vulnerability is fixed in 0.9.7.
- Product
- Lumiverse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lumiverse is a full-featured AI chat application.CVE-2026-44449 · Other software · prolix-oc · reported by GitHubCritical 9.1
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, when the primary toSmbPath(fullPath) call throws, the method falls back to a dirname/basename split and only validates the directory prefix. The basename is concatenated directly into the smbclient -c script without validation. smbclient interprets ; as a subcommand separator and !cmd as a local-shell escape that runs cmd on the host. A path whose directory component is clean but whose basename contains "; !<cmd>; echo " achieves arbitrary command execution on the Lumiverse server. This vulnerability is fixed in 0.9.7.
- Product
- Lumiverse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lumiverse is a full-featured AI chat application.CVE-2026-44444 · Other software · prolix-oc · reported by GitHubCritical 9.1
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the Spindle extension build pipeline calls bun install without the --ignore-scripts flag before running the static backend safety scan (assertSafeBackendBundle). A malicious extension that ships a package.json with a preinstall, postinstall, or prepare lifecycle script achieves host-level code execution the moment an admin presses Install before any dist file is inspected. This vulnerability is fixed in 0.9.7.
- Product
- Lumiverse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Lumiverse is a full-featured AI chat application.CVE-2026-44443 · Other software · prolix-oc · reported by GitHubMedium 4.8
Lumiverse is a full-featured AI chat application. Prior to 0.9.7, consumeNonce() only checks that the module-level variable is set and unexpired. It does not validate any value from the incoming HTTP request or bind the nonce to the admin's session. If the admin's auth.api.signUpEmail() call fails before the before hook fires (e.g. BetterAuth rejects a duplicate email at the validation layer), the nonce is set but never consumed. Any POST /api/auth/sign-up/email request that arrives during the remaining window registers successfully regardless of who sent it. An attacker who can observe or predict when the admin is creating users (must be a dupplicate user) can race the 10-second window to register an unauthorized account. This vulnerability is fixed in 0.9.7.
- Product
- Lumiverse
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Chatwoot is a customer engagement suite.CVE-2026-44707 · Other software · chatwoot · reported by GitHubMedium 6.8
Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover (Pre-ATO) vulnerability existed in Chatwoot's authentication flow. Because email confirmation was not enforced before an account became usable, an attacker could pre-register an email address they did not own and set a password. If the legitimate owner of that email later signed in to Chatwoot using Google OAuth (or another OmniAuth provider), the OAuth flow silently confirmed the existing account without invalidating the attacker's pre-set credentials. The attacker could then continue to log in with the password they had originally chosen and access any data the victim subsequently entered into the dashboard, including PII, API keys, and other sensitive information. This vulnerability is fixed in 4.13.0.
- Product
- chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Chatwoot is a customer engagement suite.CVE-2026-44706 · Other software · chatwoot · reported by GitHubHigh 8.5
Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When filtering by a custom attribute of type date or number using the is_greater_than or is_less_than operators, user-supplied values in the values field of the filter payload are interpolated directly into the SQL query without parameterization. Any authenticated user with access to an account can exploit this to execute arbitrary SQL via time-based blind injection. This affects /api/v1/accounts/{account_id}/conversations/filter, /api/v1/accounts/{account_id}/contacts/filter, and /api/v1/accounts/{account_id}/custom_attribute_definitions. This vulnerability is fixed in 4.11.2.
- Product
- chatwoot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Paid Videochat Turnkey Site: Missing AuthorizationCVE-2026-24590 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23.
- Product
- Paid Videochat Turnkey Site
- Affected
- up to 7.3.23
- What to do
- Affects up to 7.3.23. Update Paid Videochat Turnkey Site to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 22, 2026TypeBot is a chatbot builder tool.CVE-2026-39970 · Other software · baptisteArno · reported by GitHubHigh 8.5
TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain a critical stored XSS vulnerability in the app.typebot.io profile picture upload form. The application fails to sanitize or restrict SVG/XML-based uploads and directly renders them when accessed through the domain. By uploading a crafted malicious SVG file containing embedded JavaScript, an attacker will execute arbitrary JavaScript code. This vulnerability directly enables stored XSS exploitation because the payload is persistently stored on your infrastructure (app.typebot.io) and accessible from a public-facing, permanent link. Stored XSS via malicious SVG uploads to app.typebot.io allows attackers to execute arbitrary JavaScript in victims' browsers, enabling session/token theft, account takeover, and exfiltration of sensitive user data. This issue has been fixed in version 3.16.0.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026TypeBot is a chatbot builder tool.CVE-2026-39969 · Other software · baptisteArno · reported by GitHubMedium 6.5
TypeBot is a chatbot builder tool. In versions 3.16.0 and prior, the WhatsApp Cloud API webhook endpoint (POST /v1/workspaces/{workspaceId}/whatsapp/{credentialsId}/webhook) does not verify the x-hub-signature-256 HMAC signature included by Meta in every webhook delivery. The webhook URL exposes both workspaceId and credentialsId as path parameters, which are logged in web server access logs, visible in Meta's webhook configuration dashboard, and potentially shared when configuring integrations. This allows any unauthenticated attacker to send spoofed webhook messages to trigger bot flows, consume API resources, and interact with external services using the workspace owner's credentials. The issue has been fixed in version 3.17.0.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026TypeBot is a chatbot builder tool.CVE-2026-39968 · Other software · baptisteArno · reported by GitHubHigh 7.1
TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 ("Credential Theft via Client-Side Script Execution and API Authorization Bypass") is incomplete. While the builder's getCredentials tRPC endpoint was patched with workspace membership checks, the bot-engine runtime still allows any authenticated user to use credentials from any workspace via the preview chat endpoint. The bot-engine's getCredentials() utility function uses a falsy check (if (workspaceId && ...)) for workspace ownership validation. Since the preview endpoint accepts a client-controlled workspaceId field and the Zod schema allows empty strings, an attacker can supply workspaceId: "" to bypass credential ownership verification entirely. Exploitation can result in credential exfiltration, external service abuse, financial damage and a data breach.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026TypeBot is a chatbot builder tool.CVE-2026-39967 · Other software · baptisteArno · reported by GitHubLow 3.1
TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the bot engine's the findResult query does not filter results by typebotId, allowing an authenticated user to load result data (user answers, variable values) from a different typebot by supplying a foreign resultId to the startChat endpoint. Exploitation is constrained by CUID2's cryptographically random 24-character IDs (making brute-force infeasible), the requirement that rememberUser be enabled, and the need for matching variable names in the current typebot. If successfully exploited, an attacker can access the original user's previous answers, session variable values, and hasStarted flag, potentially exposing PII like names, emails, and phone numbers. This issue has been fixed in version 3.16.0.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026TypeBot is a chatbot builder tool.CVE-2026-39966 · Other software · baptisteArno · reported by GitHubMedium 6.5
TypeBot is a chatbot builder tool. In versions 3.15.2, the getLinkedTypebots API endpoint returns full bot definitions to any authenticated user who references a target bot ID in a Typebot Link block, regardless of workspace ownership, leading to IDOR. The authorization check uses Array.filter() with an async callback — since filter() is synchronous, the callback always returns a truthy Promise, so the access control predicate is never actually evaluated. Any authenticated Typebot user can read the full definition of any other workspace's private bots, including: all conversation blocks and logic flow, variable values embedded in the bot (credentials, API keys, PII), webhook URLs and integration configurations. This issue has been fixed in version 3.16.0.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026TypeBot is a chatbot builder tool.CVE-2026-39965 · Other software · baptisteArno · reported by GitHubHigh 7.7
TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain an SSRF via Open Redirect Bypass as the HTTP Request block and Code block validate the initial request URL via validateHttpReqUrl() to block private IPs and cloud metadata hostnames. However, the HTTP clients (ky and fetch) follow 302 redirects without re-validating the redirect destination. An authenticated user can point a bot block to an attacker-controlled server that responds with a redirect to an internal IP, causing the Typebot server to reach internal services. An authenticated Typebot user can reach AWS metadata (169.254.169.254), private subnets, and container-internal services. Exploitable to extract cloud IAM credentials or probe internal APIs inaccessible from the internet. This issue has been fixed in version 3.16.0.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026TypeBot is a chatbot builder tool.CVE-2026-39964 · Other software · baptisteArno · reported by GitHubMedium 5.4
TypeBot is a chatbot builder tool. In versions prior to 3.16.0, the Typebot viewer (packages/embeds/js) renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser context when clicked. Since the viewer is typically embedded in a third-party site, the attacker's JavaScript runs in the host page's origin and can exfiltrate cookies and session tokens. This can result in any authenticated Typebot user (including those on the free tier) being able to create a bot with this payload. Shared bots are publicly accessible — no victim authentication is required. This issue has been resolved in version 3.16.0.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via the chat message fCVE-2026-36228 · Other software · reported by MITREHigh 7.3
Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via the chat message functionality
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via the UserName pCVE-2026-36227 · Other software · reported by MITREMedium 6.5
Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via the UserName parameter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026TypeBot is a chatbot builder tool.CVE-2026-34207 · Other software · baptisteArno · reported by GitHubHigh 7.6
TypeBot is a chatbot builder tool. In versions prior to 3.16.0, SSRF protection for Webhook / HTTP Request blocks validates only the URL string, blocked hostname literals, and literal IP formats. It does not resolve DNS before allowing the request. As a result, a hostname such as ssrf-repro.example that resolves to 127.0.0.1, 169.254.169.254, or RFC1918/private space passes validation and is later fetched by the backend HTTP client. This enables server-side request forgery to loopback, cloud metadata, and private network targets. This issue has been resolved in version 3.16.0.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Typebot is a chatbot builder tool.CVE-2026-33712 · Other software · baptisteArno · reported by GitHubCritical 10
Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST /api/v1/typebots/{typebotId}/preview/startChat) allows unauthenticated users to achieve Server-Side Request Forgery (SSRF) by supplying a custom typebot definition with server-side code blocks. The fetch function exposed inside the isolated-vm sandbox calls Node.js native fetch without the SSRF validation (validateHttpReqUrl) that protects the HTTP Request block. This bypasses all SSRF mitigations added after GHSA-8gq9-rw7v-3jpr. Exploitation of this unauthenticated SSRF vulnerability can lead to cloud credential theft, internal network access and data exfiltration for any self-hosted Typebot deployments and hosted services. This issue has been fixed in version 3.16.0.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Typebot is a chatbot builder tool.CVE-2026-28445 · Other software · baptisteArno · reported by GitHubHigh 8.7
Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the RatingButton component in the embed package renders the user-controlled customIcon.svg field directly via Solid's innerHTML directive without any sanitization, even though DOMPurify is already a dependency and is used elsewhere in the codebase (e.g., StreamingBubble.tsx). Because rating blocks are not flagged as isUnsafe by the import sanitizer and the builder preview renders bots inline on the builder's own origin (builder.typebot.io) under a CSP permitting 'unsafe-inline', a malicious imported or collaborator-crafted typebot can execute arbitrary HTML/JS in the builder's authenticated context, bypassing the Web Worker sandbox that protects Script blocks during preview. This allows session hijacking and privilege escalation within the builder application. This issue has been fixed in version 3.16.0.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Typebot is a chatbot builder tool.CVE-2026-28444 · Other software · baptisteArno · reported by GitHubMedium 6.5
Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the getResultLogs API endpoint authorizes the caller against the provided typebotId but fetches logs solely by resultId without verifying that the result belongs to the authorized typebot, leading to IDOR. An authenticated attacker can supply their own typebotId alongside any victim's resultId to read execution logs from other workspaces, leaking sensitive data including HTTP response bodies, AI model outputs, and webhook payloads. Every other result-scoped endpoint in the same router properly validates that the resultId belongs to the authorized typebotId. This confirms the missing check is an oversight, not a design choice. This issue has been fixed in version 3.15.2.
- Product
- typebot.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2026Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand.CVE-2026-46473 · Other software · TCHATZI · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand. Secrets were generated using Perl's built-in rand function, which is predictable and unsuitable for security usage.
- Product
- Authen::TOTP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
May 20, 2026AI Chatbot & Workflow Automation by AIWU: Stored Cross-Site ScriptingCVE-2026-2955 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-Forwarded-For' header in versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Practical exploitation is constrained due to a 20-character storage limit.
- Product
- AI Chatbot & Workflow Automation by AIWU
- Affected
- up to 1.4.14
- What to do
- Affects up to 1.4.14. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 19, 2026BLOGCHAT Chat System: Cross-Site Request ForgeryCVE-2026-8420 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The BLOGCHAT Chat System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6.3. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- BLOGCHAT Chat System
- Affected
- up to 1.3.6.3
- What to do
- Affects up to 1.3.6.3. Update BLOGCHAT Chat System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2026The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated uCVE-2026-32994 · Other software · Rocket.Chat · reported by support@hackerone.comMedium 5.3
The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated user to retrieve the full content of any message from any room (private groups, direct messages, channels) by simply providing the target message ID. The endpoint fetches the message via Messages.findOneById(messageId) with no room access check (canAccessRoomIdAsync is never called), returning the complete IMessage object including message text, sender info, room ID, timestamps, and markdown content.
- Product
- Rocket.Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2026Zechat 1.5 contains a SQL injection vulnerability in the v parameter that allows unauthenticated attackers to extract database information using time-based blinCVE-2018-25339 · Other software · Bylancer · reported by VulnCheckHigh 8.8
Zechat 1.5 contains a SQL injection vulnerability in the v parameter that allows unauthenticated attackers to extract database information using time-based blind techniques. Attackers can exploit the v parameter with sleep-based blind injection to confirm vulnerability and extract data.
- Product
- Zechat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbylancer.comexploit-db.com
May 17, 2026Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-basCVE-2018-25338 · Other software · Bylancer · reported by VulnCheckHigh 8.8
Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-based techniques. Attackers can exploit the hashtag parameter with union-based payloads to retrieve table and column names.
- Product
- Zechat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbylancer.comexploit-db.com
May 17, 2026Zechat 1.5 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to change a user's information by bypassing anti-CSRF protections.CVE-2018-25334 · Other software · Bylancer · reported by VulnCheckMedium 5.3
Zechat 1.5 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to change a user's information by bypassing anti-CSRF protections. The application uses a CSRF token, but an attacker can use the hashtag parameter to inject an encoded payload and bypass the CSRF protection, allowing for unauthorized changes to user data. This can be exploited by tricking a user into submitting a crafted form or by using a script to obtain and set the CSRF token.
- Product
- Zechat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbylancer.comexploit-db.com
May 17, 2026AI Engine – The Chatbot, AI Framework & MCP for: Privilege Escalation in version 3CVE-2026-8719 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Privilege Escalation in version 3.4.9. This is due to missing WordPress capability enforcement in the MCP OAuth bearer-token authorization path, where any valid OAuth token causes MCP access to be granted without verifying administrator privileges. This makes it possible for authenticated (Subscriber+) attackers to invoke admin-level MCP tools and escalate privileges to Administrator.
- Product
- AI Engine – The Chatbot, AI Framework & MCP for
- What to do
- Update AI Engine – The Chatbot, AI Framework & MCP for to the newest version.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 15, 2026Essential Chat Support: Authorization bypassCVE-2026-8681 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset all plugin configuration settings — including general settings, display rules, custom CSS, and WooCommerce tab settings — to their defaults by sending a POST request with ecs_reset_settings=1.
- Product
- Essential Chat Support
- Affected
- up to 1.0.1
- What to do
- Affects up to 1.0.1. Update Essential Chat Support to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 14, 2026Live Helper Chat is an open-source application that enables live support websites.CVE-2026-44633 · Other software · LiveHelperChat · reported by GitHubHigh 8.1
Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can change the chat hash and status and then access or tamper with the chat through visitor/widget paths. The same write primitive can set operation_admin, which is later emitted as operator-side JavaScript.
- Product
- livehelperchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.CVE-2026-41712 · Other software · VMware · reported by security@vmware.comHigh 7.5
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
- Product
- Spring AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026AI Chatbot & Workflow Automation by AIWU: SQL InjectionCVE-2026-2993 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.17 due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query in the getListForTbl() function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This issue is partially mitigated by a patch in version 1.4.11 that adds a nonce check for a nonce that is only available to administrators.
- Product
- AI Chatbot & Workflow Automation by AIWU
- Affected
- up to 1.4.17
- What to do
- Affects up to 1.4.17. Update AI Chatbot & Workflow Automation by AIWU to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 11, 2026DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents.CVE-2026-43900 · Other software · ThinkInAIXYZ · reported by GitHubCritical 9.3
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS) vulnerability exists due to a discrepancy between the backend validation layer and the frontend browser rendering engine. The SVGSanitizer (src/main/lib/svgSanitizer.ts) restricts script execution by scrubbing javascript: protocols using plain-text regular expressions. However, it fails to account for HTML entity decoding prior to Vue's v-html DOM insertion inside the SvgArtifact.vue component. By feeding an SVG artifact with obfuscated entities (e.g., javascript:alert(1)), an attacker can completely bypass the sanitizer, culminating in arbitrary JavaScript execution when a victim interacts with the rendered SVG Element. This vulnerability is fixed in v1.0.4-beta.1.
- Product
- deepchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents.CVE-2026-43899 · Other software · ThinkInAIXYZ · reported by GitHubCritical 9.6
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerable to an arbitrary protocol execution bypass (RCE). While the patch correctly restricted api.openExternal() inside the renderer's preload/index.ts script, it structurally neglected to sanitize native Electron pop-up window handlers. An attacker or a compromised AI endpoint returning a Markdown link can trigger a target="_blank" native window interception in tabPresenter.ts, which forwards the malicious URL directly to shell.openExternal(url) and completely bypasses the isValidExternalUrl security boundary. This vulnerability is fixed in v1.0.4-beta.1.
- Product
- deepchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root containCVE-2026-44996 · Other software · OpenClaw · reported by VulnCheckMedium 6.3
OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root containment checks. Attackers can influence agent or tool-produced ReplyPayload.mediaUrl parameters to resolve absolute local paths or file URLs, read audio-like files, and embed them base64-encoded into webchat responses.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.CVE-2026-42456 · Other software · Mintplex-Labs · reported by GitHubMedium 4.3
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, GET /api/workspace/:slug/tts/:chatId in AnythingLLM returns the text-to-speech audio for another user's chat response within the same workspace because the route validates workspace membership but does not enforce ownership of the targeted chat row. As a result, an authenticated user can access another user's private assistant response in audio form if the chatId is known or guessed. This constitutes an insecure direct object reference (IDOR) affecting private chat response content exposed through the TTS endpoint. This issue has been patched in version 1.12.1.
- Product
- anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to discloseCVE-2026-33111 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.
- Product
- Copilot Chat (Microsoft Edge)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information overCVE-2026-26164 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Copilot's Business Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information overCVE-2026-26129 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.5
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- Product
- Microsoft 365 Copilot's Business Chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026A vulnerability in the Lite Agent feature of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct browser-based attackCVE-2026-20172 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the Lite Agent feature of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct browser-based attacks. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Agent. This vulnerability is due to inadequate validation of file contents during file upload operations. An attacker could exploit this vulnerability by uploading a file that contains malicious scripts or HTML code, which the application could make available to other users to access. A successful exploit could allow the attacker to execute the contents of that file in the browser of a user and conduct browser-based attacks.
- Product
- Cisco Enterprise Chat and Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
May 5, 2026A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3.CVE-2026-7847 · Other software · chatchat-space · reported by VulDBLow 1.2
A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded File Handler. Performing a manipulation results in insufficiently random values. Access to the local network is required for this attack. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Langchain-Chatchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3.CVE-2026-7846 · Other software · chatchat-space · reported by VulDBLow 1.2
A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component OpenAI-Compatible File Upload API. Such manipulation of the argument file.filename leads to time-of-check time-of-use. Access to the local network is required for this attack to succeed. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Langchain-Chatchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3.CVE-2026-7845 · Other software · chatchat-space · reported by VulDBLow 1.2
A flaw has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. This issue affects the function PIL.Image.tobytes of the file libs/chatchat-server/chatchat/webui_pages/dialogue/dialogue.py of the component Vision Chat Paste Image Handler. This manipulation of the argument paste_image.image_data causes use of weak hash. The attacker needs to be present on the local network. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Langchain-Chatchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3.CVE-2026-7844 · Other software · chatchat-space · reported by VulDBLow 2.1
A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. This vulnerability affects the function files/list_files/retrieve_file/retrieve_file_content/delete_file of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Compatible File Service. The manipulation results in missing authentication. The attacker must have access to the local network to execute the attack. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- Langchain-Chatchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation: SQL InjectionCVE-2026-3456 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' parameter in versions up to, and including, 1.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation
- Affected
- up to 1.2.0
- What to do
- Affects up to 1.2.0. Update GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
May 2, 2026A vulnerability has been found in ChatGPTNextWeb NextChat up to 2.16.1.CVE-2026-7644 · Other software · ChatGPTNextWeb · reported by VulDBMedium 5.5
A vulnerability has been found in ChatGPTNextWeb NextChat up to 2.16.1. Affected is the function addMcpServer of the file app/mcp/actions.ts. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- NextChat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.