CVE-2026-40535: Improper Limitation of a Pathname to a Restricted Directory

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks...

CVE-2026-40533: Exposure of Sensitive Information Through Data Queries

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to obtain non-sensitive information...

The vulnerability of the client for remote desktop clients on Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Remote Desktop Client for Windows operating systems in dealing with client remote desktops is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-75588

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

CVE-2026-12284

Mattermost Desktop App versions =6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server or a user with script access to a connected server view to disconnect an active call belonging to a different connected server via the...

CVE-2026-12284 Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Mattermost Desktop App versions =6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server or a user with script access to a connected server view to disconnect an active call belonging to a different connected server via the...

CVE-2026-12284

Mattermost Desktop App versions

EUVD-2026-81680

Mattermost Desktop App versions =6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server or a user with script access to a connected server view to disconnect an active call belonging to a different connected server via the...

CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

CVE-2026-75588

Mattermost Desktop App versions

EUVD-2026-81678

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

CVE-2026-75588 Mattermost Desktop App plugin popout scheme validation bypass

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

CVE-2026-92839

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session...

CVE-2026-92839

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session...

EUVD-2026-81317

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session...

CVE-2026-92839

Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session...

CVE-2026-92839

Canva Desktop versions prior to v1.125.0 are affected by a double decoding flaw in the application's deeplink handler. An attacker can exploit this to load arbitrary same-origin content under a victim's active session, resulting in a Low integrity impact with no confidentiality or availability im...

PT-2026-94361

Mattermost Desktop App versions =6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server or a user with script access to a connected server view to disconnect an active call belonging to a different connected server via the...

PT-2026-94365

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...

CVE-2026-75588: Improper Validation of Specified Type of Input

Mattermost Desktop App versions =6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout window over an insecure connection via a link using a downgraded URL scheme...