Advisories · Technology
stoatchat.
Every CVE that names stoatchat among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket
- stoatchat
- Broken access control
- CVSS 8.3 High
stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting
- stoatchat
- Authentication bypass
- CVSS 6.9 Medium
stoatchat before 0.15.5 Account Enumeration via Error Location
- stoatchat
- Information disclosure
- CVSS 8.8 High
stoatchat before 0.15.5 Local Filesystem Read via SVG
- stoatchat
- CWE-693
- CVSS 7.1 High
stoatchat before 0.15.5 Denial of Service via mass mentions
- stoatchat
- CWE-248
- CVSS 5.3 Medium
stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization
- stoatchat
- CWE-180
- CVSS 8.3 High
stoatchat before 0.15.0 Missing Authorization via Subscribe
- stoatchat
- Broken access control
- CVSS 7.1 High
stoatchat before 0.15.0 Permission Bypass via message_fetch
- stoatchat
- Broken access control
- CVSS 6.9 Medium
stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass
- stoatchat
- Server-side request forgery (SSRF)
- CVSS 8.7 High
stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service
- stoatchat
- Denial of service
- CVSS 7.7 High
stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass
- stoatchat
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
stoatchat before 0.7.8 Unrestricted Account Creation
- stoatchat
- CWE-1173
- CVSS 9.2 CriticalCritical · CVSS 9+
stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints
- stoatchat
- Server-side request forgery (SSRF)
- CVSS 7.6 High
stoatchat 20241213-1 Webhook Token Disclosure via Read Permissions
- stoatchat
- Broken access control
- CVSS 8.7 High
stoatchat before 20250210-1 Unrestricted Message History Fetch
- stoatchat
- CWE-1025