CVE-2026-107181High 8.1Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme0.6%
CVE-2026-94488High 8.2Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless 0.1%
CVE-2021-47793High 7.5Telegram Desktop 2.9.2 - Denial of Service (PoC)0.5%