CVE.report search for "Telegram"
Listed below are 50 relevant search results for "Telegram" based on Vendor, Software, and CVE description
These results are gathered from attempted matches with listed vendor and software data, as well as a keyword search in the description of all known CVEs.
If you notice a "Not Listed" in either the vendor or software columns, the underlying source record does not currently include normalized affected-product data.
Search Results
| CVE ID | Vendor | Software | Description |
|---|---|---|---|
| CVE-2026-111105 | Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut... | ||
| CVE-2026-110769 | holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messag... | ||
| CVE-2026-110768 | holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that autho... | ||
| CVE-2026-109427 | Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token hol... | ||
| CVE-2026-109426 | Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB da... | ||
| CVE-2026-108756 | Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scope... | ||
| CVE-2026-107181 | Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote at... | ||
| CVE-2026-101050 | Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_i... | ||
| CVE-2026-100536 | OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to... | ||
| CVE-2026-94488 | Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in butt... | ||
| CVE-2026-93747 | The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'telegram' profile field in versio... | ||
| CVE-2026-93514 | Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions. | ||
| CVE-2026-92814 | changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup inj... | ||
| CVE-2026-85454 | Themoos | Core-moos | MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that writes a NUL te... |
| CVE-2026-78268 | Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram... | ||
| CVE-2026-76066 | IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates... | ||
| CVE-2026-73031 | telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaSc... | ||
| CVE-2026-65096 | Linux | Linux Kernel | NVIDIA NemoClaw for Linux contains a vulnerability in the Telegram bridge component, where an attacker could cause an OS comm... |
| CVE-2026-59155 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/... | ||
| CVE-2026-56832 | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves... | ||
| CVE-2026-55096 | fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept fi... | ||
| CVE-2026-54638 | gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_mess... | ||
| CVE-2026-53807 | Openclaw | Openclaw | OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in Telegram interactive callbacks that allows authent... |
| CVE-2026-52830 | fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the ra... | ||
| CVE-2026-49410 | OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow c... | ||
| CVE-2026-48976 | HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo... | ||
| CVE-2026-41359 | Openclaw | Openclaw | OpenClaw before 2026.3.28 contains a privilege escalation vulnerability allowing authenticated operators with write permissio... |
| CVE-2026-41340 | Openclaw | Openclaw | OpenClaw before 2026.3.31 contains an authentication boundary vulnerability where Telegram legacy allowFrom migration incorre... |
| CVE-2026-41331 | Openclaw | Openclaw | OpenClaw before 2026.3.31 contains a resource consumption vulnerability in Telegram audio preflight transcription that allows... |
| CVE-2026-40732 | Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions. | ||
| CVE-2026-35661 | Openclaw | Openclaw | OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Telegram callback query handling that allows atta... |
| CVE-2026-35628 | Openclaw | Openclaw | OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attac... |
| CVE-2026-32982 | Openclaw | Openclaw | OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Tele... |
| CVE-2026-32980 | Openclaw | Openclaw | OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-t... |
| CVE-2026-23807 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Socio WP Telegram Wi... | ||
| CVE-2026-18964 | The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin... | ||
| CVE-2026-16204 | A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This affects the function tool_run_script_execute of the f... | ||
| CVE-2026-15298 | The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14... | ||
| CVE-2026-7701 | A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestBu... | ||
| CVE-2026-7620 | The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including... | ||
| CVE-2025-68589 | Missing Authorization vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Exploiting Incorrec... | ||
| CVE-2025-67720 | Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames rece... | ||
| CVE-2025-62993 | Missing Authorization vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Exploiting Incor... | ||
| CVE-2025-58794 | Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cros... | ||
| CVE-2025-48268 | Missing Authorization vulnerability in Guru Team Bot for Telegram on WooCommerce bot-for-telegram-on-woocommerce allows Explo... | ||
| CVE-2025-30949 | Deserialization of Untrusted Data vulnerability in Guru Team Site Chat on Telegram site-chat-on-telegram allows Object Inject... | ||
| CVE-2025-13068 | The Telegram Bot & Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Telegram username in all... | ||
| CVE-2024-38789 | Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi Telegram Bot & Channel telegram-bot allows Cross Site Request... | ||
| CVE-2024-9821 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing aut... | ||
| CVE-2024-9630 | 10web | Wps Telegram Chat | The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when acces... |