|
1741
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the getResultLogs API endpoint authorizes the caller against the provided typebotId but fetches logs solely by resultId without verify…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-28444
|
2026-05-23 03:27 |
2026-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1742
|
8.7 |
HIGH
Network
|
-
|
-
|
Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the RatingButton component in the embed package renders the user-controlled customIcon.svg field directly via Solid's innerHTML direct…
|
CWE-79
Cross-site Scripting
|
CVE-2026-28445
|
2026-05-23 03:27 |
2026-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1743
|
10.0 |
CRITICAL
Network
|
-
|
-
|
Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST /api/v1/typebots/{typebotId}/preview/startChat) allows unauthenticated users to achieve Server-Side Re…
|
CWE-862
CWE-918
Missing Authorization
Server-Side Request Forgery (SSRF)
|
CVE-2026-33712
|
2026-05-23 03:27 |
2026-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1744
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via the UserName parameter
|
CWE-22
Path Traversal
|
CVE-2026-36227
|
2026-05-23 03:27 |
2026-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1745
|
7.3 |
HIGH
Network
|
-
|
-
|
Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via the chat message functionality
|
CWE-120
Classic Buffer Overflow
|
CVE-2026-36228
|
2026-05-23 03:27 |
2026-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1746
|
7.3 |
HIGH
Network
|
-
|
-
|
An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login page endpoint and HTTP response security headers components
|
CWE-1021
Improper Restriction of Rendered UI Layers or Frames
|
CVE-2026-37470
|
2026-05-23 03:27 |
2026-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1747
|
6.1 |
MEDIUM
Network
|
-
|
-
|
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML befo…
|
-
|
CVE-2026-42506
|
2026-05-23 03:16 |
2026-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1748
|
6.1 |
MEDIUM
Network
|
-
|
-
|
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML befo…
|
-
|
CVE-2026-42502
|
2026-05-23 03:16 |
2026-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1749
|
6.1 |
MEDIUM
Network
|
-
|
-
|
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML befo…
|
-
|
CVE-2026-25681
|
2026-05-23 03:16 |
2026-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1750
|
8.8 |
HIGH
Network
|
ivanti
|
secure_access_client
|
An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arbitrary code.
|
CWE-295
Improper Certificate Validation
|
CVE-2026-8992
|
2026-05-23 02:50 |
2026-05-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
