baptisteArno vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20252
3. 202631

Newest CVEs

• CVE-2026-62865

  TypeBot: Arbitrary server file read via Send Email block attachment path

  baptisteArno · typebot.io

  High8.7
• CVE-2026-62861

  TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain

  baptisteArno · typebot.io

  Medium6.4
• CVE-2026-62862

  TypeBot: Account takeover via brute-forceable 6-digit magic-link code

  baptisteArno · typebot.io

  Critical9.1
• CVE-2026-48763

  TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath

  baptisteArno · typebot.io

  High8.2
• CVE-2026-48762

  TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler

  baptisteArno · typebot.io

  Medium5.4
• CVE-2026-48765

  TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

  baptisteArno · typebot.io

  Critical9.9
• CVE-2026-47705

  TypeBot vulnerable to CSV injection in result export

  baptisteArno · typebot.io

  Critical9.6
• CVE-2026-48767

  Google Sheets OAuth access token disclosure to guest members via getAccessToken

  baptisteArno · typebot.io

  High7.6
• CVE-2026-48494

  TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids

  baptisteArno · typebot.io

  High7.1
• CVE-2026-47704

  TypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bot's waiting session

  baptisteArno · typebot.io

  High7.1