Mattermost Desktop App code issues and vulnerabilities

The Mattermost Desktop App is a desktop application for message communication developed by the American company Mattermost. Versions 6.1, 6.0.1, and 5.4.13.0 of the Mattermost Desktop App have code vulnerabilities. These vulnerabilities stem from a failure to prevent servers from rendering conten...

Microsoft M365 Copilot for Desktop has a deception vulnerability

Microsoft M365 Copilot is an AI-driven productivity tool developed by the American company Microsoft. Microsoft M365 Copilot for Desktop has a deception vulnerability, and attackers can exploit this vulnerability to carry out deceptive attacks...

CVE-2026-4643: Improper Check for Unusual or Exceptional Conditions

Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server or plugin to crash the desktop client via invoking window.close in the renderer context, leading to...

CVE-2026-3471: Improper Authorization in Handler for Custom URL Scheme

Mattermost Desktop App versions =6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling window.open'javascript:alert';. Mattermost Advisory ID: MMSA-2026-00...

XRDP Server Buffer Overflow

The vulnerability of the XRDP server is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

XRDP Server Buffer Overflow DoS

The vulnerability of the XRDP server is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure or execute arbitrary code...

XRDP Server Heap Buffer Overflow DoS

The vulnerability of the XRDP server is related to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

XRDP Server RCE

The vulnerability of the XRDP server is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level and execute arbitrary code...

XRDP Server Heap Buffer Overflow DoS

The vulnerability of the XRDP server is related to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

XRDP Server Code Execution

The vulnerability of the XRDP server is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows an attacker to execute arbitrary code...

XRDP Server Buffer Overflow DoS

The vulnerability of the XRDP server is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

[SECURITY] Fedora 43 Update: yelp-49.1-1.fc43

Yelp is the help browser for the GNOME desktop. It is designed to help you browse all the documentation on your system in one central tool, including traditional man pages, info pages and documentation written in DocBook...

[SECURITY] Fedora 43 Update: freerdp-3.26.0-4.fc43

The xfreerdp & wlfreerdp Remote Desktop Protocol RDP clients from the FreeR DP project. xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows machines, xrdp and VirtualBox...

Microsoft Power Automate for Desktop < 2.68.237.26118 Information Disclosure (May 2026)

The version of Microsoft Power Automate for desktop installed on the remote Windows host is prior to 2.68.237.26118. It is, therefore, affected by an information disclosure vulnerability: - Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker ...

Power Automate for Desktop Information Disclosure

The vulnerability of the Power Automate for Desktop automation platform is related to insufficient protection for operational data. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

Adobe Connect Desktop Application Privilege Escalation

The vulnerability of the Adobe Connect Desktop Application’s instant messaging feature is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

Adobe Connect Instant Messaging Code Execution

The vulnerability of the Adobe Connect Desktop Application’s instant messaging function is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Microsoft 365 Copilot < 19.2604.43111.0 Spoofing (CVE-2026-41614)

The Windows 'Microsoft 365 Copilot' app formerly known as 'Microsoft 365 Office' installed on the remote host is prior to 19.2604.43111.0. It is, therefore, affected by a spoofing vulnerability: - Improper access control in Microsoft 365 Copilot for Desktop allows an unauthorized attacker to...

CVE-2026-44467

The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in /.ssh/knownhosts without comparing the server's...

CVE-2026-44586

SiYuan is an open-source personal knowledge management system. From 2.1.12 to before 3.7.0. SiYuan's Bazaar marketplace renders package author metadata from the public bazaar stage feed into HTML without escaping. In the desktop app this becomes stored XSS, and because SiYuan's Electron windows a...