agentprime: rocketchat-rocket-chatEvery new CVE for rocketchat-rocket-chat.https://agentprime.io/CVE-2026-75575: Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Methodhttps://agentprime.io/advisories/CVE-2026-75575/https://agentprime.io/advisories/CVE-2026-75575/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 01:30:29 GMTCVECVE-2026-72919: Rocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into Teamshttps://agentprime.io/advisories/CVE-2026-72919/https://agentprime.io/advisories/CVE-2026-72919/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 21:44:59 GMTCVECVE-2026-72918: Rocket.Chat: Insecure implementation of websocket notificationshttps://agentprime.io/advisories/CVE-2026-72918/https://agentprime.io/advisories/CVE-2026-72918/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Aug 2026 21:42:36 GMTCVECVE-2026-55762: Rocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected `/api/v1/fingerprint` Endpointhttps://agentprime.io/advisories/CVE-2026-55762/https://agentprime.io/advisories/CVE-2026-55762/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 21:08:01 GMTCVECVE-2026-55759: Rocket.Chat: Apple Sign-In skips JWT claims validation, allowing expired and cross-audience token replayhttps://agentprime.io/advisories/CVE-2026-55759/https://agentprime.io/advisories/CVE-2026-55759/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 21:07:29 GMTCVECVE-2026-55666: Rocket.Chat: Email Parameter Fallback Leads To Account Takeover Within Apple OAuthhttps://agentprime.io/advisories/CVE-2026-55666/https://agentprime.io/advisories/CVE-2026-55666/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 21:06:55 GMTCVEcriticalCVE-2026-49278: Rocket.Chat: Livechat Visitor Profile Disclosure Leaks Bearer Token and Enables Visitor Impersonationhttps://agentprime.io/advisories/CVE-2026-49278/https://agentprime.io/advisories/CVE-2026-49278/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 21:05:33 GMTCVECVE-2026-49277: Rocket.Chat: OAuth access and refresh tokens remain valid after account deactivationhttps://agentprime.io/advisories/CVE-2026-49277/https://agentprime.io/advisories/CVE-2026-49277/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 21:04:09 GMTCVECVE-2026-45757: Rocket.Chat: users.deactivateIdle` deactivates accounts without revoking existing login tokenshttps://agentprime.io/advisories/CVE-2026-45757/https://agentprime.io/advisories/CVE-2026-45757/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 21:01:56 GMTCVECVE-2026-46423: Rocket.Chat: SAML signature validation skipped when IdP certificate field is emptyhttps://agentprime.io/advisories/CVE-2026-46423/https://agentprime.io/advisories/CVE-2026-46423/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 20:58:57 GMTCVEcriticalCVE-2026-45689: Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATOhttps://agentprime.io/advisories/CVE-2026-45689/https://agentprime.io/advisories/CVE-2026-45689/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 20:57:32 GMTCVEcriticalCVE-2026-45688: Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijackhttps://agentprime.io/advisories/CVE-2026-45688/https://agentprime.io/advisories/CVE-2026-45688/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 20:56:44 GMTCVEcriticalCVE-2026-45687: Rocket.Chat: Authenticated Arbitrary Data Export Theft via Mass Assignment in sendFileMessagehttps://agentprime.io/advisories/CVE-2026-45687/https://agentprime.io/advisories/CVE-2026-45687/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 20:55:25 GMTCVECVE-2026-45677: Rocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoShttps://agentprime.io/advisories/CVE-2026-45677/https://agentprime.io/advisories/CVE-2026-45677/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 20:54:13 GMTCVECVE-2026-47733: Rocket.Chat: Missing URL protocol sanitization in ImageElement allows javascript: URLs in markdown imageshttps://agentprime.io/advisories/CVE-2026-47733/https://agentprime.io/advisories/CVE-2026-47733/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 24 Jun 2026 20:51:29 GMTCVECVE-2026-30833: Rocket.Chat: NoSQL injection in the EE ddp-streamer-servicehttps://agentprime.io/advisories/CVE-2026-30833/https://agentprime.io/advisories/CVE-2026-30833/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Mar 2026 17:40:36 GMTCVECVE-2026-30831: Rocket.Chat: 2FA bypass and login of deactivated users via EE ddp-streamerhttps://agentprime.io/advisories/CVE-2026-30831/https://agentprime.io/advisories/CVE-2026-30831/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Mar 2026 17:40:27 GMTCVECVE-2026-28514: Rocket.Chat: Users can login with any password via the EE ddp-streamer-servicehttps://agentprime.io/advisories/CVE-2026-28514/https://agentprime.io/advisories/CVE-2026-28514/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Mar 2026 17:35:01 GMTCVEcriticalCVE-2026-23477: Rocket.Chat Unauthorized Access to OAuth App Detailshttps://agentprime.io/advisories/CVE-2026-23477/https://agentprime.io/advisories/CVE-2026-23477/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Jan 2026 18:16:05 GMTCVECVE-2021-32832: ReDOS in Rocket.Chathttps://agentprime.io/advisories/CVE-2021-32832/https://agentprime.io/advisories/CVE-2021-32832/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 30 Aug 2021 20:55:13 GMTCVE