Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:stoatchat:stoatchat:*:*:*:*:*:*:*:*

2 briefs RSS
medium advisory

Local File Disclosure and Denial of Service in Stoatchat January Service

An unauthenticated remote attacker can exploit an improper SVG resolution vulnerability in the Stoatchat January media proxy to perform local file enumeration, arbitrary file disclosure, and memory exhaustion via unbounded filesystem I/O.

January file-disclosure denial-of-service web-application cve-2026-100676
2t 1c
high advisory

Authentication Bypass in stoatchat via MFA Ticket Manipulation

stoatchat versions prior to 0.15.5 are vulnerable to an authentication bypass where attackers can use their own MFA ticket to authenticate against a victim's session.

stoatchat authentication-bypass mfa-bypass cve-2026-100679
1t 1c