CVE-2026-16047 Board channel linking without read channel permission validation

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fail to validate that users have read access to a channel before linking a board to it, which allows an authenticated attacker to discover the membership of private channels on the same team via creating, patching, importing...

MSC-2023-16047

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

graph.generator20 (>=1.0.0, <=1.0.2) potentially affected by CVE-2017-16047 via mysqljs (0.0.2-security)

mysqljs NPM version 0.0.2-security is affected by a known vulnerability. The following packages have a transitive dependency on mysqljs and may be impacted: - graph.generator20 =1.0.0, =1.0.2 Source cves: CVE-2017-16047 Source advisory: OSV:GHSA-8GV6-G7VP-HR34...

CVE-2017-16047

mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16047

CVE-2017-16047 corresponds to the mysqljs npm package, which is described across multiple sources as malware that steals environment variables and exfiltrates them to attacker-controlled locations. The core issue is that the package behaved as a malicious module, and all versions have been unpubl...