Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation

Mattermost versions 10.11.x 10.11.5, 11.0.x 11.0.4, 10.12.x 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy version 1 protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate a...

GHSA-X3R8-2HMH-89F5 Mattermost has an Invite Token Replay Vulnerability via Channel Membership Manipulation

Mattermost versions 10.11.x 10.11.5, 11.0.x 11.0.4, 10.12.x 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy version 1 protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to authenticate a...

EUVD-2025-203920

Mattermost versions 10.11.x = 10.11.5, 11.0.x = 11.0.4, 10.12.x = 10.12.2 fail to invalidate invite tokens after use which allows malicious actors who have intercepted invite tokens to manipulate channel memberships including adding or removing users from private channels via token replay attack...

CVE-2025-13324

Mattermost versions 10.11.x = 10.11.5, 11.0.x = 11.0.4, 10.12.x = 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy version 1 protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to...

CVE-2025-13324 Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

Mattermost versions 10.11.x = 10.11.5, 11.0.x = 11.0.4, 10.12.x = 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy version 1 protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to...

CVE-2025-13324

CVE-2025-13324 affects Mattermost server versions 10.11.x <= 10.11.5, 11.0.x <= 11.0.4, and 10.12.x

CVE-2025-13324 Lack of Invalidation of Legacy Remote Cluster Invite Tokens After Confirmation

Mattermost versions 10.11.x = 10.11.5, 11.0.x = 11.0.4, 10.12.x = 10.12.2 fail to invalidate remote cluster invite tokens when using the legacy version 1 protocol or when the confirming party does not provide a refreshed token, which allows an attacker who has obtained an invite token to...

Malicious code in trondec (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d4efad56ea7992fa8744736bf9f7b5e8eee6a521109819f7b841eb3f1ea91bbc Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2025-192605 Malicious code in trondec (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d4efad56ea7992fa8744736bf9f7b5e8eee6a521109819f7b841eb3f1ea91bbc Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

CVE-2025-10450

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional Core Libraries allows Sniffing Network Traffic.This issue affects Connext Professional: from 7.4.0 before 7., from 7.2.0 before 7.3.1...

kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns

A vulnerability was found in cloneprivatemount in fs/namespace.c in filesystem subsystem in the Linux Kernel.This flaw could allow a local attacker to crash the system or leak kernel internal information...

kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns

A vulnerability was found in cloneprivatemount in fs/namespace.c in filesystem subsystem in the Linux Kernel.This flaw could allow a local attacker to crash the system or leak kernel internal information...

kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns

A vulnerability was found in cloneprivatemount in fs/namespace.c in filesystem subsystem in the Linux Kernel.This flaw could allow a local attacker to crash the system or leak kernel internal information...

SUSE CVE-2025-68243

In the Linux kernel, the following vulnerability has been resolved: NFS: Check the TLS certificate fields in nfsmatchclient If the TLS security policy is of type RPCXPRTSECTLSX509, then the certserial and privkeyserial fields need to match as well since they define the client's identity, as...

RHEL 9 : kernel (RHSA-2025:23241)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23241 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: cloneprivatemnt: make sure th...

ProjectSend 安全漏洞

ProjectSend cFTP is the ProjectSend open source suite of self-hosted applications based on PHP and MySQL. A security vulnerability exists in ProjectSend r1605 that originates from an unauthenticated attacker who can download private files by manipulating the download ID parameter, which could lea...

PT-2025-51854

Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.5 Mattermost versions 11.0.x through 11.0.4 Mattermost versions 10.12.x through 10.12.2 Description The software does not invalidate invite tokens after they are used. This allows a malicious actor who...

PT-2025-51968

Name of the Vulnerable Software and Affected Versions ProjectSend version r1605 Description An insecure direct object reference issue exists in ProjectSend r1605. An unauthenticated attacker can download private files by manipulating the id parameter in a download request to the 'process.php'...

EUVD-2025-203800

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional Core Libraries allows Sniffing Network Traffic.This issue affects Connext Professional: from 7.4.0 before 7., from 7.2.0 before 7.3.1...

CVE-2025-10450

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional Core Libraries allows Sniffing Network Traffic.This issue affects Connext Professional: from 7.4.0 before 7., from 7.2.0 before 7.3.1...