https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T07:32:47.550662+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cnvd-2018-13099 cnvd-2018-13099 2026-10-06T07:32:47.557284+00:00 cnvd-2018-13099 https://vulnerability.circl.lu/vuln/fkie_cve-2018-13878 fkie_cve-2018-13878 2026-10-06T07:32:47.557345+00:00

An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.

 https://vulnerability.circl.lu/vuln/ghsa-8f7m-2hjp-gccx GHSA-8f7m-2hjp-gccx 2026-10-06T07:32:47.557396+00:00

An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.

 https://vulnerability.circl.lu/vuln/gsd-2018-13878 gsd-2018-13878 2026-10-06T07:32:47.557422+00:00 gsd-2018-13878 https://vulnerability.circl.lu/vuln/var-201807-0823 VAR-201807-0823 2026-10-06T07:32:47.557438+00:00

An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel. Rocket.Chat Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Rocket.Chat is an open source web chat server built in JavaScript using the Meteorfullstack framework. A cross-site scripting vulnerability exists in the packages/rocketchat-mentions/Mentions.js file in versions prior to Rocket.Chat 0.65, which was caused by the program's failure to encode the real name of the displayed username