TI-2026-30833 CVE-2026-42553 · GHSA-j944-w549-3453Cinny: Access token disclosure via invalidated emoji pack avatar URL in service workerPriority LOW 31Cinny is a Matrix client.CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00302 · Published 2026-05-27 · Fixed in 4.10.3 CWE-20