Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N L L L 5.5 .0028 18.4 —
AFFECTED Product Versions Fixed Chat ac63d25297079eed5e4ba7e88d3b7a032637150d – —
TIMELINE Sep 24 Reserved by VulDB Sep 24 Published (CNA: VulDB) Sep 25 EXPLOIT PUBLISHED — CVE-2026-97326 (songxinjianqwe Chat). Public exploit reference added.
A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
| Date | Event | Detail |
|---|---|---|
| September 24, 2026 | Reserved | Reserved by VulDB |
| September 24, 2026 | Published | Published (CNA: VulDB) |
| September 25, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-97326 (songxinjianqwe Chat). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| songxinjianqwe | Chat | — | ac63d25297079eed5e4ba7e88d3b7a032637150d | — |
Authoritative record: CVE-2026-97326 at cve.org
Vendors: songxinjianqwe
Weaknesses: CWE-918
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-97326 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
