PT-2026-97565

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.1 Description An issue exists in the trace consumer where the output path is...

CVE-2026-67224: Improper Limitation of a Pathname to a Restricted Directory

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No saferelativepath / traversal check is applied on...

CVE-2026-84150: Authorization Bypass Through User-Controlled Key

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with...

CVE-2026-82331: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

PT-2026-97244

Name of the Vulnerable Software and Affected Versions Tauri affected versions not specified Description The updater plugin verifies update binaries using minisign signatures, but the signature only covers the raw binary bytes. The update manifest, which includes the version number, download URL,...

PT-2026-97568

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description When no CA bundle is available, the ssl options/1 function fal...

PT-2026-97361

Name of the Vulnerable Software and Affected Versions alsa-lib versions prior to 1.2.16.2 Description A denial of service issue exists in the multi PCM plugin due to a failure to validate sparse binding indices before array access. An attacker can provide a malicious ALSA configuration file...

CVE-2026-96260

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

Embedded Malicious Code

Overview @memtensor/memos-cloud-openclaw-plugin is an OpenClaw lifecycle plugin for MemOS Cloud add + recall memory Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260

The Mattermost server is vulnerable to a denial of service because it fails to enforce a request body size limit during CSRF validation of plugin requests. This flaw allows an authenticated user to exhaust server memory by sending a large request body to a plugin endpoint. Affected versions inclu...

EUVD-2026-84870

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-69190 Source advisory: OSV:GHSA-M9C2-85GV-8XR5...

org.graylog.plugins:graylog-plugin-parent (>=7.1.1, <=7.1.3), org.graylog.plugins:graylog-plugin-web-parent (>=7.1.1, <=7.1.3) potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.1.1, <=7.1.3)

org.graylog2:graylog2-server MAVEN version =7.1.1, =7.1.1, =7.1.1, =7.1.3 Source cves: CVE-2026-69190 Source advisory: SNYK:JAVA-ORGGRAYLOG2-20079479...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (7.0.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (7.0.0) +3 more potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.0.0, <=7.0.8)

org.graylog2:graylog2-server MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.0.8 Source cves: CVE-2026-69190 Source advisory: SNYK:JAVA-ORGGRAYLOG2-20079479...

Improper Authorization

Overview @tauri-apps/plugin-updater is a Affected versions of this package are vulnerable to Improper Authorization via the allowDowngrades option exposed to the frontend JavaScript API, which allowed any web content running inside a Tauri application to request installation of an older, previous...

@crabnebula/taurify-api (>=0.1.0, <=0.1.3), @huakunshen/kunkun-ip-info (0.0.7) +8 more potentially affected by CVE-2026-95624 via @tauri-apps/plugin-updater (>=2.0.0-beta.3, <=2.10.1)

@tauri-apps/plugin-updater NPM version =2.0.0-beta.3, =0.1.0, =0.0.1-alpha.0, =0.0.2, =0.2.33, =0.1.1, =0.0.2-alpha.0, =0.0.2-alpha.18 - kksh 0.0.23 - kunkun-ext-letterboxd 0.0.3 Source cves: CVE-2026-95624 Source advisory: SNYK:JS-TAURIAPPSPLUGINUPDATER-20078986...

CVE-2026-95624

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check...