CVE-2026-100679 | High | 8.8 | 2026-09-26 | stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket w… |
CVE-2026-100678 | Medium | 6.5 | 2026-09-26 | stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to guess TOTP codes with… |
CVE-2026-100677 | Medium | 5.3 | 2026-09-26 | stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthentica… |
CVE-2026-100676 | High | 8.2 | 2026-09-26 | January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG <image href> values as local filesyste… |
CVE-2026-100675 | Medium | 6.5 | 2026-09-26 | stoatchat versions before 0.15.5 contain a denial of service vulnerability in the acknowledgement worker that processes mass mention messages. Authenticated us… |
CVE-2026-100674 | Medium | 4.3 | 2026-09-26 | stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden characters by submittin… |
CVE-2026-74869 | High | 7.7 | 2026-08-17 | stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate member… |
CVE-2026-73059 | Medium | 6.5 | 2026-08-16 | stoatchat before 0.15.0 contains a permission bypass vulnerability in the message_fetch route that checks only ViewChannel permission instead of requiring Read… |
CVE-2026-73058 | Medium | 5.8 | 2026-08-16 | stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protection… |
CVE-2026-73057 | High | 7.5 | 2026-08-16 | stoatchat before 0.15.0 fails to validate SVG viewBox dimensions in the proxy endpoint, allowing attackers to cause denial of service by memory exhaustion. Att… |
CVE-2026-57848 | Medium | 5.5 | 2026-07-18 | Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND in… |
CVE-2026-63088 | High | 8.6 | 2026-07-16 | stoatchat before 0.14.0 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated network-accessible attackers to bypass the DNS-… |
CVE-2026-63306 | High | 8.6 | 2026-07-16 | stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs wit… |
CVE-2025-71388 | | | 2026-07-16 | stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission on a channel to fetch that channel's we… |
CVE-2025-71377 | | | 2026-07-16 | stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the da… |
CVE-2024-58360 | Medium | 6.5 | 2026-07-16 | stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and shield verification… |