Telemessage
9 CVEs tracked since 2025. Since May 2025, 3 of them reached CISA KEV.
Telemessage CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2025-05 | 9 | 3 |
| 2025-06 | 4 or fewer | |
| 2025-07 | 5 or fewer | |
| 2025-08 | 4 or fewer | |
| 2025-09 | 4 or fewer | |
| 2025-10 | 4 or fewer | |
| 2025-11 | 4 or fewer | |
| 2025-12 | 5 or fewer | |
| 2026-01 | 5 or fewer | |
| 2026-02 | 5 or fewer | |
| 2026-03 | 7 or fewer | |
| 2026-04 | 6 or fewer | |
| 2026-05 | 7 or fewer | |
| 2026-06 | 7 or fewer | |
| 2026-07 | 7 or fewer | |
| 2026-08 | 8 or fewer | |
| 2026-09 | 9 or fewer | |
| 2026-10 | 6 or fewer |
Products
The products that kept showing up in Telemessage's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 9 most recently published vulnerabilities affecting Telemessage.
- CVE-2025-48929The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can be reused at a later date if discovere...4.0
- CVE-2025-48926The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers.4.3
- CVE-2025-48925The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then accepts the hash as the authentication credential.4.3
- CVE-2025-48928The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password previously sent over HTTP would be incl...4.0
- CVE-2025-48931The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities (including rainbow tables) with low computational effort.3.2
- CVE-2025-48930The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to an adversary through various avenues.2.8
- CVE-2025-48927The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in May 2025.5.3
- CVE-2025-47729The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which is different functionality than described in the TeleMessa...1.9
- CVE-2025-47730The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the credentials of logfile for the user an...4.8
The record
- Peak rank
- #98 in May 2025
- Busiest month shown
- May 2025, 9 CVEs
- Months with a KEV entry
- 1 since May 2025
- Monthly snapshots
- 1 since 2025