Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

104 results · page 2 of 3

Oct 25, 2024WPS Telegram Chat: Authorization bypassCVE-2024-9630 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when accessing messages in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to view the messages that are sent through the Telegram Bot API.
Product
WPS Telegram Chat
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update WPS Telegram Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2024WPS Telegram Chat: Unauthorized modification of data and loss of dataCVE-2024-9628 · WordPress plugins & themes · reported by WordfenceMedium 6.3
The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'Wps_Telegram_Chat_Admin::checkСonnection' function in versions up to, and including, 4.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to have full access to the Telegram Bot API endpoint and communicate with it.
Product
WPS Telegram Chat
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update WPS Telegram Chat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 25, 2024Order Notification for Telegram: Unauthorized test message sendingCVE-2024-9686 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Order Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nktgnfw_send_test_message' function in versions up to, and including, 1.0.1. This makes it possible for unauthenticated attackers to send a test message via the Telegram Bot API to the user configured in the settings.
Product
Order Notification for Telegram
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update Order Notification for Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 22, 2024TeploBot - Telegram Bot for WP: Sensitive information disclosureCVE-2024-9627 · WordPress plugins & themes · reported by WordfenceHigh 8.6
The TeploBot - Telegram Bot for WP plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'service_process' function in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to view the Telegram Bot Token, which is a secret token to control the bot.
Product
TeploBot - Telegram Bot for WP
Affected
up to 1.3
What to do
Affects up to 1.3. Update TeploBot - Telegram Bot for WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 14, 2024WP 2FA with Telegram: Two-Factor Authentication BypassCVE-2024-9820 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication.
Product
WP 2FA with Telegram
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP 2FA with Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 14, 2024WP 2FA with Telegram: Authentication BypassCVE-2024-9687 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validate_tg' action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator.
Product
WP 2FA with Telegram
Affected
up to 3.0
What to do
Affects up to 3.0. Update WP 2FA with Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 11, 2024Bot for Telegram on WooCommerce: Sensitive information disclosureCVE-2024-9821 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stm_wpcfto_get_settings' AJAX action in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to view the Telegram Bot Token, a secret token used to control the bot, which can then be used to log in as any existing user on the site, such as an administrator, if they know the username, due to the Login with Telegram feature.
Product
Bot for Telegram on WooCommerce
Affected
up to 1.2.7
What to do
Affects up to 1.2.7. Update Bot for Telegram on WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 9, 2024Notification for Telegram: Unauthorized test message sendingCVE-2024-9685 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nftb_test_action' function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to send a test message via the Telegram Bot API to all users configured in the settings.
Product
Notification for Telegram
Affected
up to 3.3.1
What to do
Affects up to 3.3.1. Update Notification for Telegram to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Aug 18, 2024WP Telegram Widget and Join Link: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43309 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Socio WP Telegram Widget and Join Link allows Stored XSS.This issue affects WP Telegram Widget and Join Link: from n/a through 2.1.27.
Product
WP Telegram Widget and Join Link
Affected
up to 2.1.27
What to do
Affects up to 2.1.27. Update WP Telegram Widget and Join Link to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2024EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.CVE-2024-7014 · Computers, phones & browsers · Android · reported by security@eset.comHigh 7.1
EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.
Product
Telegram for Android
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record welivesecurity.com welivesecurity.com
Jun 13, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-4149 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Product
Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
Fixed in
3.2.3
What to do
Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.2.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 5, 2024Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-SysteCVE-2024-4009 · Other software · ABB, Busch-Jaeger · reported by cybersecurity@ch.abb.comHigh 7.3
Replay Attack in ABB, Busch-Jaeger, FTS Display (version 1.00) and BCU (version 1.3.0.33) allows attacker to capture/replay KNX telegram to local KNX Bus-System
Product
2.4! Display 55, SD/U12.55.11-825
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record search.abb.com search.abb.com
May 2, 2024Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can CVE-2024-34147 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins Telegram Bot Plugin 1.4.0 and earlier stores the Telegram Bot token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Product
Jenkins Telegram Bot Plugin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com jenkins.io
Apr 29, 2024In Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type.CVE-2024-33905 · Other software · morethanwords · reported by MITREMedium 4.6
In Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type.
Product
tweb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Apr 24, 2024Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button: Does not sanitise and escape some of its settingsCVE-2024-2972 · WordPress plugins & themes · reported by WPScanLow 3.8
The Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button WordPress plugin before 3.1.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button
Fixed in
3.1.9
What to do
Update Floating Chat Widget: Contact Chat Icons, WhatsApp, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button to 3.1.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 13, 2024Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: Stored Cross-Site ScriptingCVE-2024-0898 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Product
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
Affected
up to 2.3
What to do
Affects up to 2.3. Update Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordpress.org wordfence.com
Dec 18, 2023Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: Cross-Site Request Forgery (CSRF)CVE-2023-48769 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back.This issue affects Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back: from n/a through 2.3.
Product
Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
Affected
up to 2.3
What to do
Affects up to 2.3. Update Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 29, 2023Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.CVE-2023-34658 · Other software · Telegram · reported by MITREMedium 5.3
Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record crsrg.sh exchange.xforce.ibmcloud.com
May 19, 2023Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.CVE-2023-26818 · Other software · Telegram · reported by MITREMedium 5.5
Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record danrevah.github.io danrevah.github.io
Dec 6, 2022Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website.CVE-2022-43363 · Other software · Telegram · reported by MITREMedium 6.1
Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relationship between the Pastebin information and a possible XSS finding.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugs.telegram.org pastebin.com
Dec 5, 2022Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2022-3858 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin.
Product
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button
Fixed in
3.0.3
What to do
Update Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button to 3.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 3, 2021The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248.CVE-2021-41861 · Other software · Telegram · reported by MITRELow 3.3
The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248. After approximately two to four uses of the self-destruct feature, there is a misleading UI indication that an image was deleted (on both the sender and recipient sides). The images are still present in the /Storage/Emulated/0/Telegram/Telegram Image/ directory.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record desktop.telegram.org habr.com
Sep 6, 2021Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.CVE-2021-40532 · Other software · Telegram · reported by MITRECritical 9.8
Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.
Product
Web K Alpha
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 30, 2021Telegram Web K Alpha 0.6.1 allows XSS via a document name.CVE-2021-37596 · Other software · Telegram · reported by MITREMedium 6.1
Telegram Web K Alpha 0.6.1 allows XSS via a document name.
Product
Web K Alpha
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 16, 2021A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8.CVE-2021-36769 · Other software · Telegram · reported by MITREMedium 5.3
A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mtpsym.github.io mtpsym.github.io
May 18, 2021Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty funCVE-2021-31323 · Other software · Telegram · reported by MITREMedium 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record shielder.it shielder.it
May 18, 2021Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of theirCVE-2021-31322 · Other software · Telegram · reported by MITREMedium 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record shielder.it shielder.it
May 18, 2021Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custCVE-2021-31321 · Other software · Telegram · reported by MITREHigh 7.1
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record shielder.it shielder.it
May 18, 2021Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTaCVE-2021-31320 · Other software · Telegram · reported by MITREHigh 7.1
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of their custom fork of the rlottie library. A remote attacker might be able to overwrite heap memory out-of-bounds on a victim device via a malicious animated sticker.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record shielder.it shielder.it
May 18, 2021Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their cuCVE-2021-31319 · Other software · Telegram · reported by MITREMedium 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record shielder.it shielder.it
May 18, 2021Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function oCVE-2021-31318 · Other software · Telegram · reported by MITREMedium 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record shielder.it shielder.it
May 18, 2021Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of tCVE-2021-31317 · Other software · Telegram · reported by MITREMedium 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record shielder.it shielder.it
May 18, 2021Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of tCVE-2021-31315 · Other software · Telegram · reported by MITREMedium 5.5
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record shielder.it shielder.it
Apr 20, 2021The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied messCVE-2021-30496 · Other software · telegram · reported by MITREMedium 5.7
The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language) into a channel or group. The crash occurs in MtProtoKitFramework. NOTE: the vendor's perspective is that "this behavior can't be considered a vulnerability."
Product
telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com t.me
Feb 19, 2021The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently actiCVE-2021-27351 · Other software · Telegram · reported by MITREMedium 5.3
The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 0ffsecninja.github.io security.gentoo.org
Feb 12, 2021Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure.CVE-2021-27205 · Other software · Telegram · reported by MITREMedium 5.5
Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record inputzero.io youtube.com
Feb 12, 2021Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure.CVE-2021-27204 · Other software · Telegram · reported by MITREMedium 5.5
Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record inputzero.io youtube.com
Oct 14, 2020Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard.CVE-2020-25824 · Other software · Telegram · reported by MITRELow 2.4
Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. The threat model is a victim who has voluntarily opened Export Wizard but is then distracted. An attacker then approaches the unattended desktop and pushes the Export key. This attacker may consequently gain access to all chat conversation and media files.
Product
Telegram Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 11, 2020Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat CVE-2020-17448 · Other software · Telegram · reported by MITREHigh 7.8
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension.
Product
Telegram Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 1, 2020Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URCVE-2020-12474 · Other software · Telegram · reported by MITREMedium 6.5
Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 24, 2020The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on mesCVE-2020-10570 · Other software · Telegram · reported by MITREMedium 6.1
The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying. This might be interpreted as a bypass of the passcode feature.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 11, 2019The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory.CVE-2019-16248 · Other software · Telegram · reported by MITREMedium 5.5
The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory. In other words, there is a potentially misleading UI indication that a sender can remove a recipient's copy of a previously sent image (analogous to supported functionality in which a sender can remove a recipient's copy of a previously sent message).
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com inputzero.io
Aug 23, 2019The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackCVE-2019-15514 · Other software · Telegram · reported by MITREMedium 5.3
The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g., by adding a significant fraction of a region's assigned phone numbers.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.google.com docs.google.com
Mar 25, 2019Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying mCVE-2019-10044 · Other software · Telegram · reported by MITREHigh 8.8
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Jan 3, 2019An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0.CVE-2018-3986 · Other software · Telegram · reported by talos-cna@cisco.comMedium 5.5
An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com talosintelligence.com
Dec 24, 2018The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat mCVE-2018-20436 · Other software · Telegram · reported by MITREHigh 8.1
The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more other Telegram products, such as Telegram Web-version 0.7.0. In addition, it can be interpreted as an SSRF issue. NOTE: a third party has reported that potentially unwanted behavior is caused by misconfiguration of the "Secret chats > Preview links" setting
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record misteralfa-hack.blogspot.com misteralfa-hack.blogspot.com
Oct 9, 2018An issue was discovered in the org.telegram.messenger application 4.8.11 for Android.CVE-2018-15543 · Other software · Telegram · reported by MITREMedium 6.8
An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The FingerprintManager class for Biometric validation allows authentication bypass through the callback method from onAuthenticationFailed to onAuthenticationSucceeded with null, because the fingerprint API in conjunction with the Android keyGenerator class is not implemented. In other words, an attacker could authenticate with an arbitrary fingerprint. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Oct 9, 2018An issue was discovered in the org.telegram.messenger application 4.8.11 for Android.CVE-2018-15542 · Other software · Telegram · reported by MITREMedium 6.4
An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method's return value to true. In other words, an attacker could authenticate with an arbitrary passcode. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes Android devices on which rooting has occurred
Product
Telegram
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 29, 2018Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafeCVE-2018-17780 · Other software · Telegram · reported by MITREMedium 6.5
Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P connections are accepted from clients outside of the My Contacts list.
Product
Telegram Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com inputzero.io
Sep 28, 2018Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCKS5 protocol.CVE-2018-17613 · Other software · Telegram · reported by MITRECritical 9.8
Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCKS5 protocol.
Product
Telegram Desktop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org inputzero.io

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.