{"schema_version":"2","view":"grouped","data":[{"id":13060,"cve_ids":["CVE-2026-63306"],"payload":{"kind":"advisory","title":"stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints","summary":"stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.","evidence":"cve:CVE-2026-63306","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-63306","aliases":["CVE-2026-63306"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.13.5","versionType":"semver"},{"status":"unaffected","version":"0.13.5","versionType":"semver"}],"packageURL":"pkg:github/stoatchat/stoatchat","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:37.040Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5","https://www.vulncheck.com/advisories/stoatchat-before-unauthenticated-ssrf-via-proxy-and-embed-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63306","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-07-16T13:17:07.146090Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-16T13:17:25.249Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:37.040Z"}}},"related_cves":[{"value":"CVE-2026-63306","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:caf6cdf8-e7ad-4e4e-b8d0-cf2ca734844c","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63306","advisory_id":"caf6cdf8-e7ad-4e4e-b8d0-cf2ca734844c","event_types":["advisory"],"published_at":"2026-10-25T00:16:38.583652+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-16T12:19:17.351+00:00","detail_url":"/advisories/advisory%3Acaf6cdf8-e7ad-4e4e-b8d0-cf2ca734844c","group":{"id":"advisory:caf6cdf8-e7ad-4e4e-b8d0-cf2ca734844c","revision":1,"primary_event_id":12992,"change":"published","superseded_by":[],"changed":{"id":12992,"cve_ids":["CVE-2026-63306"],"payload":{"kind":"advisory","title":"stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints","summary":"stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.","evidence":"cve:CVE-2026-63306","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-63306","aliases":["CVE-2026-63306"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.13.5","versionType":"semver"},{"status":"unaffected","version":"0.13.5","versionType":"semver"}],"packageURL":"pkg:github/stoatchat/stoatchat","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:37.040Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5","https://www.vulncheck.com/advisories/stoatchat-before-unauthenticated-ssrf-via-proxy-and-embed-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63306","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-07-16T13:17:07.146090Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-16T13:17:25.249Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:37.040Z"}}},"related_cves":[{"value":"CVE-2026-63306","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:caf6cdf8-e7ad-4e4e-b8d0-cf2ca734844c","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63306","advisory_id":"caf6cdf8-e7ad-4e4e-b8d0-cf2ca734844c","event_types":["advisory"],"published_at":"2026-10-25T00:16:38.583652+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-16T12:19:17.351+00:00","detail_url":"/events/12992"},"members":[{"id":12992,"cve_ids":["CVE-2026-63306"],"payload":{"kind":"advisory","title":"stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints","summary":"stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.","evidence":"cve:CVE-2026-63306","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","structured":{"id":"CVE-2026-63306","aliases":["CVE-2026-63306"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":9.2,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":8.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.13.5","versionType":"semver"},{"status":"unaffected","version":"0.13.5","versionType":"semver"}],"packageURL":"pkg:github/stoatchat/stoatchat","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:51:37.040Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5","https://www.vulncheck.com/advisories/stoatchat-before-unauthenticated-ssrf-via-proxy-and-embed-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-63306","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-07-16T13:17:07.146090Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-xhww-5g9p-vvq5","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-16T13:17:25.249Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:51:37.040Z"}}},"related_cves":[{"value":"CVE-2026-63306","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:caf6cdf8-e7ad-4e4e-b8d0-cf2ca734844c","priority":{"reasons":["publisher_severity"],"severity":"critical","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"critical"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63306","advisory_id":"caf6cdf8-e7ad-4e4e-b8d0-cf2ca734844c","event_types":["advisory"],"published_at":"2026-10-25T00:16:38.583652+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-16T12:19:17.351+00:00","detail_url":"/events/12992"}]}},{"id":4764,"cve_ids":["CVE-2026-100677"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Account Enumeration via Error Location","summary":"stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests.","evidence":"cve:CVE-2026-100677","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100677","aliases":["CVE-2026-100677"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T17:38:09.594Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h44h-xx2j-hp56","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-account-enumeration-via-error-location"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100677","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T17:38:01.485120Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h44h-xx2j-hp56","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:38:09.594Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:39.733Z"}}},"related_cves":[{"value":"CVE-2026-100677","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2d6a5d0e-6250-4bd8-8e78-46beac06ef31","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100677","advisory_id":"2d6a5d0e-6250-4bd8-8e78-46beac06ef31","event_types":["advisory"],"published_at":"2026-10-24T21:57:06.627908+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:39.733+00:00","detail_url":"/advisories/advisory%3A2d6a5d0e-6250-4bd8-8e78-46beac06ef31","group":{"id":"advisory:2d6a5d0e-6250-4bd8-8e78-46beac06ef31","revision":1,"primary_event_id":4783,"change":"published","superseded_by":[],"changed":{"id":4783,"cve_ids":["CVE-2026-100677"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Account Enumeration via Error Location","summary":"stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests.","evidence":"cve:CVE-2026-100677","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100677","aliases":["CVE-2026-100677"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T17:38:09.594Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h44h-xx2j-hp56","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-account-enumeration-via-error-location"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100677","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T17:38:01.485120Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h44h-xx2j-hp56","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:38:09.594Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:39.733Z"}}},"related_cves":[{"value":"CVE-2026-100677","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2d6a5d0e-6250-4bd8-8e78-46beac06ef31","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100677","advisory_id":"2d6a5d0e-6250-4bd8-8e78-46beac06ef31","event_types":["advisory"],"published_at":"2026-10-24T21:57:06.627908+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:39.733+00:00","detail_url":"/events/4783"},"members":[{"id":4783,"cve_ids":["CVE-2026-100677"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Account Enumeration via Error Location","summary":"stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthenticated attackers can distinguish between registered and unregistered email addresses by comparing error location fields returned from POST /api/auth/session/login requests.","evidence":"cve:CVE-2026-100677","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100677","aliases":["CVE-2026-100677"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T17:38:09.594Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h44h-xx2j-hp56","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-account-enumeration-via-error-location"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100677","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T17:38:01.485120Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-h44h-xx2j-hp56","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T17:38:09.594Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:39.733Z"}}},"related_cves":[{"value":"CVE-2026-100677","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:2d6a5d0e-6250-4bd8-8e78-46beac06ef31","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100677","advisory_id":"2d6a5d0e-6250-4bd8-8e78-46beac06ef31","event_types":["advisory"],"published_at":"2026-10-24T21:57:06.627908+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:39.733+00:00","detail_url":"/events/4783"}]}},{"id":4425,"cve_ids":["CVE-2026-100678"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting","summary":"stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.","evidence":"cve:CVE-2026-100678","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100678","aliases":["CVE-2026-100678"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T15:00:30.440Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-brute-force-via-insufficient-rate-limiting"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100678","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:59:59.255314Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:00:30.440Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:40.935Z"}}},"related_cves":[{"value":"CVE-2026-100678","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6368f513-d410-4e4e-9a5c-b7f89937de66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100678","advisory_id":"6368f513-d410-4e4e-9a5c-b7f89937de66","event_types":["advisory"],"published_at":"2026-10-24T21:52:23.432743+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:40.935+00:00","detail_url":"/advisories/advisory%3A6368f513-d410-4e4e-9a5c-b7f89937de66","group":{"id":"advisory:6368f513-d410-4e4e-9a5c-b7f89937de66","revision":1,"primary_event_id":4443,"change":"published","superseded_by":[],"changed":{"id":4443,"cve_ids":["CVE-2026-100678"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting","summary":"stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.","evidence":"cve:CVE-2026-100678","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100678","aliases":["CVE-2026-100678"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T15:00:30.440Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-brute-force-via-insufficient-rate-limiting"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100678","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:59:59.255314Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:00:30.440Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:40.935Z"}}},"related_cves":[{"value":"CVE-2026-100678","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6368f513-d410-4e4e-9a5c-b7f89937de66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100678","advisory_id":"6368f513-d410-4e4e-9a5c-b7f89937de66","event_types":["advisory"],"published_at":"2026-10-24T21:52:23.432743+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:40.935+00:00","detail_url":"/events/4443"},"members":[{"id":4443,"cve_ids":["CVE-2026-100678"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting","summary":"stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with only IP-based rate limiting. Attackers can reuse MFA challenge tickets across multiple failed attempts and distribute guesses across IP addresses to bypass rate limiting and gain account access.","evidence":"cve:CVE-2026-100678","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100678","aliases":["CVE-2026-100678"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T15:00:30.440Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-brute-force-via-insufficient-rate-limiting"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100678","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:59:59.255314Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-6877-g673-f5r8","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T15:00:30.440Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:40.935Z"}}},"related_cves":[{"value":"CVE-2026-100678","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:6368f513-d410-4e4e-9a5c-b7f89937de66","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100678","advisory_id":"6368f513-d410-4e4e-9a5c-b7f89937de66","event_types":["advisory"],"published_at":"2026-10-24T21:52:23.432743+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:40.935+00:00","detail_url":"/events/4443"}]}},{"id":4422,"cve_ids":["CVE-2026-100674"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization","summary":"stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit.","evidence":"cve:CVE-2026-100674","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100674","aliases":["CVE-2026-100674"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:58:59.656Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qcwh-c934-wrv5","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-username-validation-bypass-via-unicode-sanitization"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:58:48.896666Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T14:58:59.656Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:37.620Z"}}},"related_cves":[{"value":"CVE-2026-100674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f08ade50-69fc-4f85-9a3e-827a15780633","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100674","advisory_id":"f08ade50-69fc-4f85-9a3e-827a15780633","event_types":["advisory"],"published_at":"2026-10-24T21:51:31.601215+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:37.62+00:00","detail_url":"/advisories/advisory%3Af08ade50-69fc-4f85-9a3e-827a15780633","group":{"id":"advisory:f08ade50-69fc-4f85-9a3e-827a15780633","revision":1,"primary_event_id":4438,"change":"published","superseded_by":[],"changed":{"id":4438,"cve_ids":["CVE-2026-100674"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization","summary":"stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit.","evidence":"cve:CVE-2026-100674","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100674","aliases":["CVE-2026-100674"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:58:59.656Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qcwh-c934-wrv5","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-username-validation-bypass-via-unicode-sanitization"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:58:48.896666Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T14:58:59.656Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:37.620Z"}}},"related_cves":[{"value":"CVE-2026-100674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f08ade50-69fc-4f85-9a3e-827a15780633","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100674","advisory_id":"f08ade50-69fc-4f85-9a3e-827a15780633","event_types":["advisory"],"published_at":"2026-10-24T21:51:31.601215+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:37.62+00:00","detail_url":"/events/4438"},"members":[{"id":4438,"cve_ids":["CVE-2026-100674"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization","summary":"stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits to create reserved-name lookalikes, embed special characters, and exceed the 32-character storage limit.","evidence":"cve:CVE-2026-100674","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-100674","aliases":["CVE-2026-100674"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.3,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:58:59.656Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qcwh-c934-wrv5","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-username-validation-bypass-via-unicode-sanitization"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T14:58:48.896666Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T14:58:59.656Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:37.620Z"}}},"related_cves":[{"value":"CVE-2026-100674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:f08ade50-69fc-4f85-9a3e-827a15780633","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100674","advisory_id":"f08ade50-69fc-4f85-9a3e-827a15780633","event_types":["advisory"],"published_at":"2026-10-24T21:51:31.601215+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:37.62+00:00","detail_url":"/events/4438"}]}},{"id":3269,"cve_ids":["CVE-2026-100679"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket","summary":"stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.","evidence":"cve:CVE-2026-100679","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100679","aliases":["CVE-2026-100679"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T18:03:01.169Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-bypass-via-cross-account-ticket"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100679","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T18:01:30.780087Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:03:01.169Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:41.637Z"}}},"related_cves":[{"value":"CVE-2026-100679","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d5029783-2063-42b6-9b79-8504ee686992","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100679","advisory_id":"d5029783-2063-42b6-9b79-8504ee686992","event_types":["advisory"],"published_at":"2026-10-24T21:32:07.036945+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:41.637+00:00","detail_url":"/advisories/advisory%3Ad5029783-2063-42b6-9b79-8504ee686992","group":{"id":"advisory:d5029783-2063-42b6-9b79-8504ee686992","revision":1,"primary_event_id":3281,"change":"published","superseded_by":[],"changed":{"id":3281,"cve_ids":["CVE-2026-100679"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket","summary":"stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.","evidence":"cve:CVE-2026-100679","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100679","aliases":["CVE-2026-100679"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T18:03:01.169Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-bypass-via-cross-account-ticket"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100679","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T18:01:30.780087Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:03:01.169Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:41.637Z"}}},"related_cves":[{"value":"CVE-2026-100679","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d5029783-2063-42b6-9b79-8504ee686992","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100679","advisory_id":"d5029783-2063-42b6-9b79-8504ee686992","event_types":["advisory"],"published_at":"2026-10-24T21:32:07.036945+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:41.637+00:00","detail_url":"/events/3281"},"members":[{"id":3281,"cve_ids":["CVE-2026-100679"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket","summary":"stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it with a victim's session token to disable TOTP, view recovery codes, or perform other sensitive operations without providing the victim's credentials.","evidence":"cve:CVE-2026-100679","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100679","aliases":["CVE-2026-100679"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":7.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T18:03:01.169Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-mfa-bypass-via-cross-account-ticket"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100679","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-28T18:01:30.780087Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-gwg6-q3c3-97cx","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:03:01.169Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:41.637Z"}}},"related_cves":[{"value":"CVE-2026-100679","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:d5029783-2063-42b6-9b79-8504ee686992","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100679","advisory_id":"d5029783-2063-42b6-9b79-8504ee686992","event_types":["advisory"],"published_at":"2026-10-24T21:32:07.036945+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:41.637+00:00","detail_url":"/events/3281"}]}},{"id":3268,"cve_ids":["CVE-2026-100675"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Denial of Service via mass mentions","summary":"stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts.","evidence":"cve:CVE-2026-100675","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100675","aliases":["CVE-2026-100675"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T18:07:41.284Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-denial-of-service-via-mass-mentions"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100675","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:05:58.547883Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:07:41.284Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:38.319Z"}}},"related_cves":[{"value":"CVE-2026-100675","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:85d31ef5-5907-49ec-8227-b447ed1d2b92","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100675","advisory_id":"85d31ef5-5907-49ec-8227-b447ed1d2b92","event_types":["advisory"],"published_at":"2026-10-24T21:32:06.44365+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:38.319+00:00","detail_url":"/advisories/advisory%3A85d31ef5-5907-49ec-8227-b447ed1d2b92","group":{"id":"advisory:85d31ef5-5907-49ec-8227-b447ed1d2b92","revision":1,"primary_event_id":3280,"change":"published","superseded_by":[],"changed":{"id":3280,"cve_ids":["CVE-2026-100675"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Denial of Service via mass mentions","summary":"stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts.","evidence":"cve:CVE-2026-100675","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100675","aliases":["CVE-2026-100675"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T18:07:41.284Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-denial-of-service-via-mass-mentions"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100675","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:05:58.547883Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:07:41.284Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:38.319Z"}}},"related_cves":[{"value":"CVE-2026-100675","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:85d31ef5-5907-49ec-8227-b447ed1d2b92","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100675","advisory_id":"85d31ef5-5907-49ec-8227-b447ed1d2b92","event_types":["advisory"],"published_at":"2026-10-24T21:32:06.44365+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:38.319+00:00","detail_url":"/events/3280"},"members":[{"id":3280,"cve_ids":["CVE-2026-100675"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Denial of Service via mass mentions","summary":"stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated users can send five crafted role-mention messages to terminate all acknowledgement workers, disabling push notifications and mention badges deployment-wide until the API process restarts.","evidence":"cve:CVE-2026-100675","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100675","aliases":["CVE-2026-100675"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T18:07:41.284Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-denial-of-service-via-mass-mentions"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100675","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:05:58.547883Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-5gq6-v4cf-3qq8","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:07:41.284Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:38.319Z"}}},"related_cves":[{"value":"CVE-2026-100675","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:85d31ef5-5907-49ec-8227-b447ed1d2b92","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100675","advisory_id":"85d31ef5-5907-49ec-8227-b447ed1d2b92","event_types":["advisory"],"published_at":"2026-10-24T21:32:06.44365+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:38.319+00:00","detail_url":"/events/3280"}]}},{"id":3184,"cve_ids":["CVE-2026-100676"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Local Filesystem Read via SVG","summary":"January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.","evidence":"cve:CVE-2026-100676","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100676","aliases":["CVE-2026-100676"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T16:33:08.727Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qv38-hwhv-jm49","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-local-filesystem-read-via-svg"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100676","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:32:41.399938Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qv38-hwhv-jm49","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:33:08.727Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:39.014Z"}}},"related_cves":[{"value":"CVE-2026-100676","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fb87ee3f-43ee-4a11-aa26-3365af0e6820","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100676","advisory_id":"fb87ee3f-43ee-4a11-aa26-3365af0e6820","event_types":["advisory"],"published_at":"2026-10-24T21:31:13.944967+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:39.014+00:00","detail_url":"/advisories/advisory%3Afb87ee3f-43ee-4a11-aa26-3365af0e6820","group":{"id":"advisory:fb87ee3f-43ee-4a11-aa26-3365af0e6820","revision":1,"primary_event_id":3195,"change":"published","superseded_by":[],"changed":{"id":3195,"cve_ids":["CVE-2026-100676"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Local Filesystem Read via SVG","summary":"January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.","evidence":"cve:CVE-2026-100676","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100676","aliases":["CVE-2026-100676"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T16:33:08.727Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qv38-hwhv-jm49","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-local-filesystem-read-via-svg"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100676","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:32:41.399938Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qv38-hwhv-jm49","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:33:08.727Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:39.014Z"}}},"related_cves":[{"value":"CVE-2026-100676","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fb87ee3f-43ee-4a11-aa26-3365af0e6820","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100676","advisory_id":"fb87ee3f-43ee-4a11-aa26-3365af0e6820","event_types":["advisory"],"published_at":"2026-10-24T21:31:13.944967+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:39.014+00:00","detail_url":"/events/3195"},"members":[{"id":3195,"cve_ids":["CVE-2026-100676"],"payload":{"kind":"advisory","title":"stoatchat before 0.15.5 Local Filesystem Read via SVG","summary":"January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml. An unauthenticated remote attacker who causes the service to proxy an attacker-hosted SVG (e.g. via the /proxy endpoint) can determine whether local files exist through observable response-time differences, and can cause supported local image files to be disclosed after re-encoding. Because each referenced file is read in full with no effective limit on the number or total volume of reads, a single request can also generate an unbounded amount of local filesystem I/O and memory pressure (the published proof of concept drives about 4.34 GB of reads), leading to denial of service. The issue is fixed in 0.15.5.","evidence":"cve:CVE-2026-100676","products":[{"name":{"value":"stoatchat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-100676","aliases":["CVE-2026-100676"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"stoatchat","product":"stoatchat","versions":[{"status":"affected","version":"0","lessThan":"0.15.5","versionType":"semver"},{"status":"unaffected","version":"0.15.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-28T16:33:08.727Z","provider":"cve","references":["https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qv38-hwhv-jm49","https://www.vulncheck.com/advisories/stoatchat-before-0.15.5-local-filesystem-read-via-svg"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-100676","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T16:32:41.399938Z"}}}],"references":[{"url":"https://github.com/stoatchat/stoatchat/security/advisories/GHSA-qv38-hwhv-jm49","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T16:33:08.727Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-26T13:23:39.014Z"}}},"related_cves":[{"value":"CVE-2026-100676","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:fb87ee3f-43ee-4a11-aa26-3365af0e6820","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100676","advisory_id":"fb87ee3f-43ee-4a11-aa26-3365af0e6820","event_types":["advisory"],"published_at":"2026-10-24T21:31:13.944967+00:00","technologies":["core-cve","stoatchat"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-26T13:23:39.014+00:00","detail_url":"/events/3195"}]}}],"next_after":13060,"next_before":3184}