Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-66749

Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup

Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with the same defect reachable through multiple code paths including the socket.io interface.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sdelements
Products
Lets-chat
CVE-2026-66750

Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can enumerate adjacent MongoDB ObjectIds derived from a known file ID to recover files uploaded by other users, as the GET /files/:id/:name route in app/controllers/files.js only enforces login authentication without consulting room membership or the Room.canJoin check.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sdelements
Products
Lets-chat
CVE-2026-66751

Let's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room

Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and permanently archive private or password-protected rooms they cannot access, with no application-level recovery path requiring direct database intervention to restore.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sdelements
Products
Lets-chat