CVE-2025-49965

Cross-Site Request Forgery CSRF vulnerability in Oganro PixelBeds Channel Manager and Hotel Booking Engine pixelbeds-channel-manager-booking-engine allows Cross Site Request Forgery.This issue affects PixelBeds Channel Manager and Hotel Booking Engine: from n/a through = 1.0...

CVE-2025-3227

Mattermost versions 10.5.x = 10.5.5, 9.11.x = 9.11.15, 10.8.x = 10.8.0, 10.7.x = 10.7.2, 10.6.x = 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public...

CVE-2025-49965

CVE-2025-49965 is a CSRF vulnerability in WordPress PixelBeds Channel Manager and Hotel Booking Engine, affecting versions 1.0 and earlier. The issue enables cross-site requests initiated by a logged-in user with no privileges required, requiring user interaction. Public details confirm affected ...

CVE-2025-6344

creationtimestamp| type| source ---|---|--- 2025-06-20 14:43:37+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18961 2025-06-20 15:00:49+00:00| published-proof-of-concept| Telegram/ELqo32PKv7z349nKjiZ4revbQx4dwMSgVYErvGHOmduZBo...

CVE-2025-3227 Unauthorized channel member management through playbook runs

Mattermost versions 10.5.x = 10.5.5, 9.11.x = 9.11.15, 10.8.x = 10.8.0, 10.7.x = 10.7.2, 10.6.x = 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public...

CVE-2025-3227 Unauthorized channel member management through playbook runs

Mattermost versions 10.5.x = 10.5.5, 9.11.x = 9.11.15, 10.8.x = 10.8.0, 10.7.x = 10.7.2, 10.6.x = 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public...

CVE-2025-3227

Mattermost CVE-2025-3227 affects multiple releases (10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x

CVE-2025-3227 Unauthorized channel member management through playbook runs

Mattermost versions 10.5.x = 10.5.5, 9.11.x = 9.11.15, 10.8.x = 10.8.0, 10.7.x = 10.7.2, 10.6.x = 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public...

CVE-2025-6335

creationtimestamp| type| source ---|---|--- 2025-06-20 11:46:58+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18935...

CVE-2025-5255

creationtimestamp| type| source ---|---|--- 2025-06-20 10:44:18+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18929...

CVE-2022-50145

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sf-pdma: Add multithread support for a DMA channel When we get a DMA channel and try to use it in multiple threads it will cause oops and hanging the system. % echo 64 /sys/module/dmatest/parameters/threadsperchan % ec...

Security update for openssl-3

This update for openssl-3 fixes the following issues: CVE-2025-27587: timing side-channel vulnerability in the P-384 implementation when used with ECDSA bsc1243459. CVE-2024-12797: Fixed that RFC7250 handshakes with unauthenticated servers don't abort as expected. bsc1236599 CVE-2024-13176: Fixed...

Use-After-Free

pycares is vulnerable to use-after-free. The vulnerability is due to improper lifecycle management of the Channel object, which allows it to be garbage collected while DNS queries are still pending...

The vulnerability of the Secure Channel component of the Cryptographic Services service in Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Secure Channel component of the Cryptographic Services service in Windows operating systems is related to the lack of memory release after the effective lifespan of the component. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CVE-2025-49965: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Oganro PixelBeds Channel Manager and Hotel Booking Engine pixelbeds-channel-manager-booking-engine allows Cross Site Request Forgery.This issue affects PixelBeds Channel Manager and Hotel Booking Engine: from n/a through = 1.0...

CVE-2025-3227: Incorrect Authorization

Mattermost versions 10.5.x = 10.5.5, 9.11.x = 9.11.15, 10.8.x = 10.8.0, 10.7.x = 10.7.2, 10.6.x = 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public...

WordPress plugin PixelBeds Channel Manager and Hotel Booking Engine 跨站请求伪造漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in WordPress plugin...

CVE-2025-48945: Use After Free

pycares is a Python module which provides an interface to c-ares. c-ares is a C library that performs DNS requests and name resolutions asynchronously. Prior to version 4.9.0, pycares is vulnerable to a use-after-free condition that occurs when a Channel object is garbage collected while DNS...

PT-2025-26324 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.15 Mattermost versions 10.5.x through 10.5.5 Mattermost versions 10.6.x through 10.6.5 Mattermost versions 10.7.x through 10.7.2 Mattermost versions 10.8.x through 10.8.0 Description: The issue is relat...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a privilege issue vulnerability that stems from not properly enforcing channel member management privileges, which can be exploited by an attacker to enable unauthorized users t...