https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-01T12:48:40.635352+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-119664 fkie_cve-2026-119664 2026-11-01T12:48:40.637078+00:00

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.

 https://db.gcve.eu/vuln/ghsa-cqj4-h3hg-hjvc GHSA-cqj4-h3hg-hjvc 2026-11-01T12:48:40.637159+00:00

Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history.