TI-2026-38599 CVE-2026-53525
WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication
Priority HIGH 68
WeeChat (Wee Enhanced Environment for Chat) is a free chat client.
weechat
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
weechat records in CISA KEVNo weechat vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records
Priority MEDIUM 62
WeeChat (Wee Enhanced Environment for Chat) is a free chat client.
TI-2020-07189 CVE-2020-8955 · GHSA-j94p-wg5x-c7xg
irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote…
Priority MEDIUM 48
irc_mode_channel_update in plugins/irc/irc-mode.c in WeeChat through 2.7 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a malfor…
TI-2020-07845 CVE-2020-9760 · GHSA-v7rw-j9c8-92qq
An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected).
Priority MEDIUM 46
An issue was discovered in WeeChat before 2.7.1 (0.3.4 to 2.7 are affected).
TI-2024-31065 CVE-2024-46613 · GHSA-q743-h9vw-38hv
WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at…
Priority MEDIUM 43
WeeChat before 4.4.2 has an integer overflow and resultant buffer overflow at core/core-string.c when there are more than two billion items in a list.
TI-2017-10792 CVE-2017-14727 · GHSA-ppv9-cgrm-wr3p
logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime…
Priority LOW 38
logger.c in the logger plugin in WeeChat before 1.9.1 allows a crash via strftime date/time specifiers, because a buffer is not initialized.
TI-2017-05663 CVE-2017-8073 · GHSA-67v2-2xg7-wff8
WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC…
Priority LOW 38
WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin.
TI-2021-17557 CVE-2021-40516 · GHSA-82mm-45xg-j4xh
WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a…
Priority LOW 36
WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin.
TI-2022-11111 CVE-2022-28352 · GHSA-q6x4-wf9q-6g23
WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly…
Priority LOW 22
WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to sp…