CVE-2026-6541

Mattermost versions 11.7.x = 11.7.1, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a...

CVE-2026-57786

creationtimestamp| type| source ---|---|--- 2026-07-13 11:08:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjkivcoiu2w...

CVE-2026-57379

creationtimestamp| type| source ---|---|--- 2026-07-13 11:04:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjkbrsxph2i 2026-07-16 07:56:17+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqr57txq32g...

CVE-2026-57369

creationtimestamp| type| source ---|---|--- 2026-07-13 11:03:10+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjk6m4vk222 2026-07-13 18:55:41+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkelkgb7c27 2026-07-14 01:21:35+00:00| seen|...

CVE-2026-6541 Unscoped updates to other playbooks' metric configuration

Mattermost versions 11.7.x = 11.7.1, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a...

CVE-2026-6541

Mattermost versions 11.7.x = 11.7.1, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a...

EUVD-2026-43341

Mattermost versions 11.7.x = 11.7.1, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a...

CVE-2026-6541 Unscoped updates to other playbooks' metric configuration

Mattermost versions 11.7.x = 11.7.1, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which allows an authenticated user with team access to alter another user’s playbook metric settings via a crafted import or update request with a...

CVE-2026-6541

CVE-2026-6541 affects Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, and 10.11.x

CVE-2026-57385

creationtimestamp| type| source ---|---|--- 2026-07-13 10:51:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjjk26yaa2i...

CGA-57H2-PFRX-X2QC

Bulletin has no description...

CVE-2026-15557 waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authentication

A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This...

EUVD-2026-43334

A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This...

CVE-2026-15557 waooAI waoowaoo Internal Task Header api-auth.ts requireProjectAuthLight improper authentication

A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This...

CVE-2026-61971

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through = 2.6.3...

CVE-2026-14165

creationtimestamp| type| source ---|---|--- 2026-07-13 08:29:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjblrq2px2s 2026-07-13 09:42:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjfoycfip2w 2026-07-16 07:53:45+00:00| seen|...

CVE-2026-15531

creationtimestamp| type| source ---|---|--- 2026-07-13 06:30:26+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqj2wvxzcs2e 2026-07-13 21:25:03+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkmwms2f32w...

CVE-2026-12582 Library Management System < 3.5.8 - Unauthenticated SQL Injection via book_id

The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes...

CVE-2026-12582 Library Management System < 3.5.8 - Unauthenticated SQL Injection via book_id

The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes...

CVE-2026-12271 Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR

The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail...