TE
Vendor
Telegram
46
CVEs
0
On KEV
2
New 30D
Products
TD9.8
Telegram Desktop
Telegram
11 CVEs0 on KEV1 new
TE8.8
Telegram
Telegram
28 CVEs0 on KEV1 new
TM8.8
Telegram Messenger
Telegram
2 CVEs0 on KEV0 new
WK9.8
Web K Alpha
Telegram
2 CVEs0 on KEV0 new
DE4.3
Desktop
Telegram
1 CVEs0 on KEV0 new
ME7.5
Messenger
Telegram
1 CVEs0 on KEV0 new
WE8.1
Web
Telegram
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111105 | TE Telegram Telegram | 7.0 | Oct 15 | Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability |
| CVE-2026-107181 | TD Telegram Desktop Telegram | 8.1 | Oct 7 | Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme |
| CVE-2026-94488 | TD Telegram Desktop Telegram | 8.2 | Sep 21 | Telegram Desktop before 6.9.4 allows XSS in the HTML exporter |
| CVE-2026-7701 | DE Desktop Telegram | 4.3 | May 3 | Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereference |
| CVE-2021-47793 | TD Telegram Desktop Telegram | 7.5 | Jan 15 | Telegram Desktop 2.9.2 - Denial of Service (PoC) |
| CVE-2024-7014 | TE Telegram Telegram | 8.1 | Jul 23 | Improper multimedia file attachment validation in Telegram for Android app |
| CVE-2023-34658 | TE Telegram Telegram | 5.3 | Jun 29 | Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController |
| CVE-2023-26818 | TE Telegram Telegram | 5.5 | May 19 | Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag |
| CVE-2022-43363 | TE Telegram Telegram | 6.1 | Dec 6 | Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website |
| CVE-2021-41861 | TE Telegram Telegram | 3.3 | Oct 4 | The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248 |
| CVE-2021-40532 | WK Web K Alpha Telegram | 9.8 | Sep 6 | Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension |
| CVE-2021-37596 | WK Web K Alpha Telegram | 6.1 | Jul 30 | Telegram Web K Alpha 0.6.1 allows XSS via a document name |
| CVE-2021-36769 | TE Telegram Telegram | 5.3 | Jul 17 | A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8 |
| CVE-2021-31323 | TE Telegram Telegram | 5.5 | May 18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their… |
| CVE-2021-31322 | TE Telegram Telegram | 5.5 | May 18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the… |
| CVE-2021-31321 | TE Telegram Telegram | 7.1 | May 18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the… |
| CVE-2021-31320 | TE Telegram Telegram | 7.1 | May 18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of… |
| CVE-2021-31319 | TE Telegram Telegram | 5.5 | May 18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the… |
| CVE-2021-31318 | TE Telegram Telegram | 5.5 | May 18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork… |
| CVE-2021-31317 | TE Telegram Telegram | 5.5 | May 18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library |
| CVE-2021-31315 | TE Telegram Telegram | 5.5 | May 18 | Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library |
| CVE-2021-30496 | TE Telegram Telegram | 5.7 | Apr 20 | The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the… |
| CVE-2021-27351 | TE Telegram Telegram | 5.3 | Feb 19 | The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session |
| CVE-2021-27205 | TE Telegram Telegram | 5.5 | Feb 12 | Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure |
| CVE-2021-27204 | TE Telegram Telegram | 5.5 | Feb 12 | Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure |
| CVE-2020-25824 | TD Telegram Desktop Telegram | 2.4 | Oct 14 | Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard |
| CVE-2020-17448 | TD Telegram Desktop Telegram | 7.8 | Aug 11 | Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a… |
| CVE-2020-12474 | TD Telegram Desktop Telegram | 6.5 | May 1 | Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat… |
| CVE-2020-10570 | TE Telegram Telegram | 6.1 | Mar 24 | The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and… |
| CVE-2019-16248 | TE Telegram Telegram | 5.5 | Sep 11 | The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory |
| CVE-2019-15514 | TE Telegram Telegram | 5.3 | Aug 23 | The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these… |
| CVE-2019-10044 | TE Telegram Telegram | 8.8 | Mar 25 | Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing… |
| CVE-2018-3986 | TE Telegram Telegram | 5.5 | Jan 3 | An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0 |
| CVE-2018-20436 | TE Telegram Telegram | 8.1 | Dec 24 | The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that… |
| CVE-2018-15543 | TE Telegram Telegram | 6.8 | Oct 9 | An issue was discovered in the org.telegram.messenger application 4.8.11 for Android |
| CVE-2018-15542 | TE Telegram Telegram | 6.4 | Oct 9 | An issue was discovered in the org.telegram.messenger application 4.8.11 for Android |
| CVE-2018-17780 | TD Telegram Desktop Telegram | 6.5 | Sep 29 | Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior… |
| CVE-2018-17613 | TD Telegram Desktop Telegram | 9.8 | Sep 28 | Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCKS5 protocol |
| CVE-2018-17231 | TD Telegram Desktop Telegram | 7.5 | Sep 19 | Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers… |
| CVE-2017-17715 | TM Telegram Messenger Telegram | 8.8 | Dec 16 | The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a… |
| CVE-2014-8688 | ME Messenger Telegram | 7.5 | Mar 14 | An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android |