agentprime: baptistearno-typebot-ioEvery new CVE for baptistearno-typebot-io.https://agentprime.io/CVE-2026-62865: TypeBot: Arbitrary server file read via Send Email block attachment pathhttps://agentprime.io/advisories/CVE-2026-62865/https://agentprime.io/advisories/CVE-2026-62865/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 21:52:16 GMTCVECVE-2026-62861: TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomainhttps://agentprime.io/advisories/CVE-2026-62861/https://agentprime.io/advisories/CVE-2026-62861/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 21:46:24 GMTCVECVE-2026-62862: TypeBot: Account takeover via brute-forceable 6-digit magic-link codehttps://agentprime.io/advisories/CVE-2026-62862/https://agentprime.io/advisories/CVE-2026-62862/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 21:43:21 GMTCVEcriticalCVE-2026-48763: TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePathhttps://agentprime.io/advisories/CVE-2026-48763/https://agentprime.io/advisories/CVE-2026-48763/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 20:51:24 GMTCVECVE-2026-48762: TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handlerhttps://agentprime.io/advisories/CVE-2026-48762/https://agentprime.io/advisories/CVE-2026-48762/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 20:40:31 GMTCVECVE-2026-48765: TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object bindinghttps://agentprime.io/advisories/CVE-2026-48765/https://agentprime.io/advisories/CVE-2026-48765/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 20:37:48 GMTCVEcriticalCVE-2026-47705: TypeBot vulnerable to CSV injection in result exporthttps://agentprime.io/advisories/CVE-2026-47705/https://agentprime.io/advisories/CVE-2026-47705/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 17:16:12 GMTCVEcriticalCVE-2026-48767: Google Sheets OAuth access token disclosure to guest members via getAccessTokenhttps://agentprime.io/advisories/CVE-2026-48767/https://agentprime.io/advisories/CVE-2026-48767/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 17:13:51 GMTCVECVE-2026-48494: TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session idshttps://agentprime.io/advisories/CVE-2026-48494/https://agentprime.io/advisories/CVE-2026-48494/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 17:09:33 GMTCVECVE-2026-47704: TypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bot's waiting sessionhttps://agentprime.io/advisories/CVE-2026-47704/https://agentprime.io/advisories/CVE-2026-47704/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 16:23:07 GMTCVECVE-2026-48483: TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot serverhttps://agentprime.io/advisories/CVE-2026-48483/https://agentprime.io/advisories/CVE-2026-48483/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 16:21:21 GMTCVECVE-2026-48495: TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebotshttps://agentprime.io/advisories/CVE-2026-48495/https://agentprime.io/advisories/CVE-2026-48495/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 15:57:24 GMTCVECVE-2026-48766: TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrlhttps://agentprime.io/advisories/CVE-2026-48766/https://agentprime.io/advisories/CVE-2026-48766/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 15:55:20 GMTCVECVE-2026-42142: TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Accesshttps://agentprime.io/advisories/CVE-2026-42142/https://agentprime.io/advisories/CVE-2026-42142/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 15:45:41 GMTCVECVE-2026-47702: TypeBot API tokens stored in plaintexthttps://agentprime.io/advisories/CVE-2026-47702/https://agentprime.io/advisories/CVE-2026-47702/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 11 Aug 2026 14:03:22 GMTCVEcriticalCVE-2026-49213: TypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request executionhttps://agentprime.io/advisories/CVE-2026-49213/https://agentprime.io/advisories/CVE-2026-49213/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 21:33:43 GMTCVECVE-2026-48764: TypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypasshttps://agentprime.io/advisories/CVE-2026-48764/https://agentprime.io/advisories/CVE-2026-48764/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 17 Jun 2026 23:29:49 GMTCVECVE-2026-48768: TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileNamehttps://agentprime.io/advisories/CVE-2026-48768/https://agentprime.io/advisories/CVE-2026-48768/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 17 Jun 2026 23:13:41 GMTCVEcriticalCVE-2026-48759: TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)https://agentprime.io/advisories/CVE-2026-48759/https://agentprime.io/advisories/CVE-2026-48759/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 17 Jun 2026 21:56:35 GMTCVECVE-2026-39969: TypeBot: WhatsApp Webhook Endpoint Missing Signature Verificationhttps://agentprime.io/advisories/CVE-2026-39969/https://agentprime.io/advisories/CVE-2026-39969/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 18:43:39 GMTCVECVE-2026-39967: TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filterhttps://agentprime.io/advisories/CVE-2026-39967/https://agentprime.io/advisories/CVE-2026-39967/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 18:36:23 GMTCVECVE-2026-39968: TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpointhttps://agentprime.io/advisories/CVE-2026-39968/https://agentprime.io/advisories/CVE-2026-39968/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 18:26:55 GMTCVECVE-2026-39966: TypeBot: Async filter() bypasses authorization, allowing IDOR in getLinkedTypebots and leaking cross-workspace bot definitionshttps://agentprime.io/advisories/CVE-2026-39966/https://agentprime.io/advisories/CVE-2026-39966/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 18:12:32 GMTCVECVE-2026-39970: TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture Formhttps://agentprime.io/advisories/CVE-2026-39970/https://agentprime.io/advisories/CVE-2026-39970/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 17:55:56 GMTCVECVE-2026-39965: TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blockshttps://agentprime.io/advisories/CVE-2026-39965/https://agentprime.io/advisories/CVE-2026-39965/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 17:27:39 GMTCVECVE-2026-34207: TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validationhttps://agentprime.io/advisories/CVE-2026-34207/https://agentprime.io/advisories/CVE-2026-34207/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 17:12:15 GMTCVECVE-2026-33712: TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controlshttps://agentprime.io/advisories/CVE-2026-33712/https://agentprime.io/advisories/CVE-2026-33712/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 16:50:04 GMTCVEcriticalCVE-2026-28444: Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosurehttps://agentprime.io/advisories/CVE-2026-28444/https://agentprime.io/advisories/CVE-2026-28444/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 22 May 2026 16:00:58 GMTCVECVE-2025-64709: Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Blockhttps://agentprime.io/advisories/CVE-2025-64709/https://agentprime.io/advisories/CVE-2025-64709/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 13 Nov 2025 19:42:42 GMTCVEcriticalCVE-2025-64706: Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposurehttps://agentprime.io/advisories/CVE-2025-64706/https://agentprime.io/advisories/CVE-2025-64706/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 13 Nov 2025 17:49:29 GMTCVECVE-2024-30264: typebot.io: `GHSL-2024-040`https://agentprime.io/advisories/CVE-2024-30264/https://agentprime.io/advisories/CVE-2024-30264/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 04 Apr 2024 20:18:08 GMTCVE