Baptistearno vulnerabilities
34 CVEs and advisories name Baptistearno as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-62865TypeBot: Arbitrary server file read via Send Email block attachment path
- CVE-2026-62861TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain
- CVE-2026-62862TypeBot: Account takeover via brute-forceable 6-digit magic-link code
- CVE-2026-48763TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath
- CVE-2026-48762TypeBot Vulnerable to Server-Side Request Forgery (SSRF) in OpenAI Transcription Handler
- CVE-2026-48765TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding
- CVE-2026-47705TypeBot vulnerable to CSV injection in result export
- CVE-2026-48767Google Sheets OAuth access token disclosure to guest members via getAccessToken
- CVE-2026-48494TypeBot vulnerable to cross-typebot WhatsApp preview webhook resume via global `wa-preview-{phone}` session ids
- CVE-2026-47704TypeBot vulnerable to cross-typebot webhook resume via unchecked `resultId` lineage allows unauthorized control of another bot's waiting session
- CVE-2026-48483TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server
- CVE-2026-48495TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots
- CVE-2026-48766TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl
- CVE-2026-42142TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access
- CVE-2026-47702TypeBot API tokens stored in plaintext
- CVE-2026-49213TypeBot: SSRF protection bypass via IPv6 unspecified address in Typebot HTTP request execution
- CVE-2026-48764TypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypass
- CVE-2026-48768TypeBot: Unauthenticated arbitrary s3 object write in generate-upload-url via unsanitized fileName
- CVE-2026-48759TypeBot: Cross-Workspace Theme Template IDOR (Modification and Deletion)
- CVE-2026-39969TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification
- CVE-2026-39967TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter
- CVE-2026-39968TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint
- CVE-2026-39966TypeBot: Async filter() bypasses authorization, allowing IDOR in getLinkedTypebots and leaking cross-workspace bot definitions
- CVE-2026-39970TypeBot: Stored Cross-Site Scripting (XSS) via SVG File Upload On Profile Picture Form
- CVE-2026-39965TypeBot: SSRF via Open Redirect Bypass in HTTP Request and Code Blocks
- CVE-2026-39964TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers
- CVE-2026-34207TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation
- CVE-2026-33712TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls
- CVE-2026-28445Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview
- CVE-2026-28444Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure