BbaptisteArno

Products

Exploited and recent CVEs

• CVE-2026-62865 High 8.7 TypeBot: Arbitrary server file read via Send Email block attachment path 0.3%
• CVE-2026-62861 Medium 6.4 TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain 0.4%
• CVE-2026-62862 Critical 9.1 TypeBot: Account takeover via brute-forceable 6-digit magic-link code 0.5%
• CVE-2026-48763 High 8.2 TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath 0.5%
• CVE-2026-48762 Medium 5.4 TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler 0.3%
• CVE-2026-48765 Critical 9.9 TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding 0.5%
• CVE-2026-47705 Critical 9.6 TypeBot vulnerable to CSV injection in result export 0.6%
• CVE-2026-48767 High 7.6 Google Sheets OAuth access token disclosure to guest members via getAccessToken 0.4%
• CVE-2026-48494 High 7.1 TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids 0.5%
• CVE-2026-47704 High 7.1 TypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bot's waiting session 0.6%
• CVE-2026-48483 Medium 5.4 TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server 0.3%
• CVE-2026-48495 High 7.1 TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots 0.4%
• CVE-2026-48766 High 7.6 TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl 0.4%
• CVE-2026-42142 High 7.1 TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access 0.4%
• CVE-2026-47702 Critical 9.1 TypeBot API tokens stored in plaintext 0.3%
• CVE-2026-49213 High 8.1 TypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request execution 0.4%
• CVE-2026-48764 High 8.2 TypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypass 0.3%
• CVE-2026-48768 Critical 9.3 TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName 0.3%
• CVE-2026-48759 High 7.1 TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion) 0.2%
• CVE-2026-39969 Medium 6.5 TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification 0.1%
• CVE-2026-39967 Low 3.1 TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter 0.2%
• CVE-2026-39968 High 7.1 TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint 0.3%
• CVE-2026-39966 Medium 6.5 TypeBot: Async filter() bypasses authorization, allowing IDOR in getLinkedTypebots and leaking cross-workspace bot definitions 0.3%
• CVE-2026-39970 High 8.5 TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture Form 0.3%
• CVE-2026-39965 High 7.7 TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks 0.2%
• CVE-2026-39964 Medium 5.4 TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers 0.2%
• CVE-2026-34207 High 7.6 TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation 0.2%
• CVE-2026-33712 Critical 10.0 TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls 0.3%
• CVE-2026-28445 High 8.7 Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview 0.3%
• CVE-2026-28444 Medium 6.5 Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure 0.3%