Stoat

Open source, user-first chat platform and Discord alternative

Alternative to: discord

About Versions (67)

v0.15.5

2026-09-12

GHSA-5gq6-v4cf-3qq8 -> Authenticated users can disable push notifications and mention badges deployment-wide
GHSA-qv38-hwhv-jm49 -> Crafted SVG files result in local filesystem reads
GHSA-h44h-xx2j-hp56 -> Error source locations allow unauthenticated account enumeration
GHSA-6877-g673-f5r8 -> MFA guessing attempts are insufficiently ratelimited
GHSA-gwg6-q3c3-97cx -> MFA Tickets are usable cross-account bypassing MFA
GHSA-qcwh-c934-wrv5 -> Username validation bypass through post-validation Unicode sanitization