89 matches found
CVE-2026-18795
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...
CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...
CVE-2026-18795
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x
CVE-2026-18795 Missing server side validation allowed user to quarantine a DM and GM post
Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated user to quarantine a post belonging to DM or GM via direct API call.. Mattermost Advisory ID: MMSA-2026-00756...
Mattermost authorization issue vulnerabilities
Mattermost versions 11.10.0 and earlier, 11.7.9 and earlier, 11.9.1 and earlier, as well as 11.8.5 and earlier have an authorization issue vulnerability. This vulnerability stems from the server-side failure to enforce DM/GM checks. Authenticated users can use direct API calls to isolate posts th...
Malicious code in @zalastax/nolb-gm (npm)
The package @zalastax/nolb-gm was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in gm-kilo (npm)
Source: amazon-inspector b4a35ea8669a2b02f60117ecc483176741399084b0fbebf11900d0a89505d9fb package.json declares an install lifecycle script that runs bin/gm-kilo.js install. At install time, the script executes bun x gm-plugkit@latest spool /dev/null 2&1 & via execSync, which downloads and runs...
fancy-nlp (>=0.0.1, <=0.0.4), gm (>=3.0.0.82, <=3.0.0.107) +3 more potentially affected by CVE-2026-0994 via protobuf (3.4.0)
protobuf PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - fancy-nlp =0.0.1, =3.0.0.82, =0.0.1, =1.0.0, =0.3.4.2, =0.3.5 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...
fancy-nlp (>=0.0.1, <=0.0.4), gm (>=3.0.0.82, <=3.0.0.107) +3 more potentially affected by CVE-2025-4565 via protobuf (3.4.0)
protobuf PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - fancy-nlp =0.0.1, =3.0.0.82, =0.0.1, =1.0.0, =0.3.4.2, =0.3.5 Source cves: CVE-2025-4565 Source advisory: OSV:PYSEC-2026-1806...
Malicious Package
Overview @gm-rvg/root-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malware in @gm-rvg/root-config
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in gm-kilo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4a35ea8669a2b02f60117ecc483176741399084b0fbebf11900d0a89505d9fb package.json declares an install lifecycle script that runs bin/gm-kilo.js install. At install time, the script executes bun x gm-plugkit@latest spoo...
MAL-2026-4574 Malicious code in gm-kilo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4a35ea8669a2b02f60117ecc483176741399084b0fbebf11900d0a89505d9fb package.json declares an install lifecycle script that runs bin/gm-kilo.js install. At install time, the script executes bun x gm-plugkit@latest spoo...
MINI-FPX2-95GM-374C
Bulletin has no description...
CVE-2015-7982
Versions of "gm" prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into "gm.compare", which fails to sanitize input correctly before calling the graphics magic binary...
10er10 (0.23.0), 7th-setin (1.0.2) +405 more potentially affected by CVE-2015-7982 via gm (>=0.5.0, <=1.20.0)
gm NPM version =0.5.0, =0.0.13, =0.0.1, =1.1.0, =1.0.0, =1.1.0, =1.0.0, =0.3.4, =0.5.0, =0.3.1, =0.0.1, =1.3.0, =3.9.1-patch1, =3.11.2-patch1 and more Source cves: CVE-2015-7982 Source advisory: MEND:CVE-2015-7982...
OESA-2026-2224 perl-Image-ExifTool security update
ExifTool is a Perl module with an included command-line application for reading and writing meta information in image, audio, and video files. It reads EXIF, GPS, IPTC, XMP, JFIF, MakerNotes, GeoTIFF, ICC Profile, Photoshop IRB, FlashPix, AFCP, and ID3 meta information from JPG, JP2, TIFF, GIF,...
EUVD-2026-26500
A vulnerability was detected in Exiftool up to 13.53. Impacted is the function Processmrld of the file lib/Image/ExifTool/GM.pm of the component JPEG/QuickTime/MOV/MP4. The manipulation of the argument -ee results in code injection. Attacking locally is a requirement. Upgrading to version 13.54 i...
CVE-2026-7580
ExifTool
CVE-2026-7580 Exiftool JPEG/QuickTime/MOV/MP4 GM.pm Process_mrld code injection
A vulnerability was detected in Exiftool up to 13.53. Impacted is the function Processmrld of the file lib/Image/ExifTool/GM.pm of the component JPEG/QuickTime/MOV/MP4. The manipulation of the argument -ee results in code injection. Attacking locally is a requirement. Upgrading to version 13.54 i...