These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-74869 debrief based on the supplied source corpus. The vulnerability is a missing authorization issue in the Subscribe message handler of stoatchat before version 0.15.0, allowing authenticated attackers to enumerate members and monitor profile updates of private servers without membership. This issue has a high severity and requires immediate attention from defenders responsible for stoatchat de [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-16T14:16:55.370Z and has not been modified since then. This CVE-2026-73058 vulnerability affects stoatchat versions before 0.15.0. The vulnerability allows unauthenticated attackers to bypass Server-Side Request Forgery (SSRF) protections via the /proxy and /embed endpoints by crafting requests usin [truncated]
CVE-2026-73057 debrief based on the supplied source corpus. The CVE record was published on 2026-08-16T14:16:55.230Z and has not been modified since then. The NVD entry is currently Deferred. Defenders responsible for stoatchat deployments should assess exposure and prioritize verifying the version in use, as well as implementing compensating controls to mitigate potential memory exhaustion attacks. This [truncated]
The Stoat for Android application contains a vulnerability that allows an attacker to disclose internal files by exploiting the ShareTargetActivity component. This component is exported and can be reached by any process on the device via the android.intent.action.SEND intent. The activity does not validate or filter the incoming URI before using it as an outgoing attachment, allowing an attacker to pass a [truncated]
A server-side request forgery (SSRF) vulnerability exists in stoatchat before version 0.14.0. This vulnerability allows unauthenticated network-accessible attackers to bypass the DNS-based IP blocklist. The issue arises from incomplete address validation in the url_is_blacklisted function, which only inspects the first resolved address while the underlying HTTP client iterates over all cached addresses.
CVE-2025-71388 is a high-severity vulnerability in stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1. The issue allows users with only ViewChannel (read) permission on a channel to fetch that channel's webhooks, including their tokens. Using a retrieved token, an attacker can send arbitrary messages to the channel, bypassing channel permissions and impersonating a bot or webhook. The vul [truncated]
A logic error was found in the query messages route of stoatchat (delta) versions before 20250210-1 (0.8.2). This error allows a remote unauthenticated attacker to craft requests that can download the entire message history of a channel in a single request, potentially leading to denial of service through resource exhaustion. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity.
CVE-2024-58360 is a vulnerability in stoatchat versions before 0.7.8 that allows for unrestricted account creation. This issue arises from the failure to enforce account creation restrictions, including invite-only mode, email verification, captcha, and shield verification. As a result, attackers can create unlimited accounts with unverified email addresses, increasing the risk of denial-of-service attack [truncated]