# stoatchat.

Every CVE that names stoatchat among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket](https://agentprime.io/advisories/CVE-2026-100679.md)
  `CVE-2026-100679` · CVE record: stoatchat stoatchat · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting](https://agentprime.io/advisories/CVE-2026-100678.md)
  `CVE-2026-100678` · CVE record: stoatchat stoatchat · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [stoatchat before 0.15.5 Account Enumeration via Error Location](https://agentprime.io/advisories/CVE-2026-100677.md)
  `CVE-2026-100677` · CVE record: stoatchat stoatchat · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Information disclosure
- [stoatchat before 0.15.5 Local Filesystem Read via SVG](https://agentprime.io/advisories/CVE-2026-100676.md)
  `CVE-2026-100676` · CVE record: stoatchat stoatchat · CVSS 8.8 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-693
- [stoatchat before 0.15.5 Denial of Service via mass mentions](https://agentprime.io/advisories/CVE-2026-100675.md)
  `CVE-2026-100675` · CVE record: stoatchat stoatchat · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-248
- [stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization](https://agentprime.io/advisories/CVE-2026-100674.md)
  `CVE-2026-100674` · CVE record: stoatchat stoatchat · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-180
- [stoatchat before 0.15.0 Missing Authorization via Subscribe](https://agentprime.io/advisories/CVE-2026-74869.md)
  `CVE-2026-74869` · CVE record: stoatchat stoatchat · CVSS 8.3 High · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control
- [stoatchat before 0.15.0 Permission Bypass via message_fetch](https://agentprime.io/advisories/CVE-2026-73059.md)
  `CVE-2026-73059` · CVE record: stoatchat stoatchat · CVSS 7.1 High · Not analysed yet · Published 16 Aug 2026 · Tags: Broken access control
- [stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass](https://agentprime.io/advisories/CVE-2026-73058.md)
  `CVE-2026-73058` · CVE record: stoatchat stoatchat · CVSS 6.9 Medium · Not analysed yet · Published 16 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service](https://agentprime.io/advisories/CVE-2026-73057.md)
  `CVE-2026-73057` · CVE record: stoatchat stoatchat · CVSS 8.7 High · Not analysed yet · Published 16 Aug 2026 · Tags: Denial of service
- [stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass](https://agentprime.io/advisories/CVE-2026-63088.md)
  `CVE-2026-63088` · CVE record: stoatchat stoatchat · CVSS 7.7 High · Not analysed yet · Published 16 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [stoatchat before 0.7.8 Unrestricted Account Creation](https://agentprime.io/advisories/CVE-2024-58360.md)
  `CVE-2024-58360` · CVE record: stoatchat stoatchat · CVSS 6.9 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-1173
- [stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints](https://agentprime.io/advisories/CVE-2026-63306.md)
  `CVE-2026-63306` · CVE record: stoatchat stoatchat · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [stoatchat 20241213-1 Webhook Token Disclosure via Read Permissions](https://agentprime.io/advisories/CVE-2025-71388.md)
  `CVE-2025-71388` · CVE record: stoatchat stoatchat · CVSS 7.6 High · Not analysed yet · Published 16 Jul 2026 · Tags: Broken access control
- [stoatchat before 20250210-1 Unrestricted Message History Fetch](https://agentprime.io/advisories/CVE-2025-71377.md)
  `CVE-2025-71377` · CVE record: stoatchat stoatchat · CVSS 8.7 High · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-1025

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=stoatchat>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/stoatchat/>. Everything for agents: <https://agentprime.io/llms.txt>.