Mattermost Improper Access Control Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an Improper Access Control vulnerability that stems from improper access control and can be exploited by an attacker to retrieve user activity logs...

SUSE CVE-2025-24866

Mattermost versions 9.11.x = 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs...

Citrix Cloud VDIs hosted in Azure by Citrix Cloud shut down constantly with user sessions

When creating VDIs from a Master image that are rolled out with MCS into a Azure subscription - Users machines are constantly shutting down - Even when users are logged onto the machines, they consistently get shutdown after several minutes it can vary between 3-5 | 25-30 -The user will see a...

Sensitive Information Disclosure

Weblate is vulnerable to Sensitive Information Disclosure. The vulnerability is due to exposed sensitive data due to source repository URLs containing credentials being included in client-side URL parameters and logs in plaintext...

Unauthorized Access

@directus/api is vulnerable to Unauthorized Data Access. The vulnerability is due to insecure logging practices. Specifically, the access token in the query string is not redacted when the LOGSTYLE is set to raw, allowing sensitive information to be exposed in system logs...

Microsoft Secures MSA Signing with Azure Confidential VMs Following Storm-0558 Breach

Microsoft on Monday announced that it has moved the Microsoft Account MSA signing service to Azure confidential virtual machines VMs and that it's also in the process of migrating the Entra ID signing service as well. The disclosure comes about seven months after the tech giant said it completed...

PT-2025-41938

Name of the Vulnerable Software and Affected Versions Argo Workflows versions prior to 3.6.12 Argo Workflows versions 3.7.0 through 3.7.2 Description Argo Workflows is a container-native workflow engine for Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact...

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is due to insufficient enforcement of access restrictions on the /api/v4/audits endpoint, allowing users with delegated granular administration roles to access User Activity Logs without Compliance...

Exploit for Missing Authentication for Critical Function in Erlang Erlang\/Otp

Security research on Erlang/OTP SSH CVE-2025-32433 Python exp...

UBUNTU-CVE-2025-40325

In the Linux kernel, the following vulnerability has been resolved: md/raid10: wait barrier before returning discard request with REQNOWAIT raid10handlediscard should wait barrier before returning a discard bio which has REQNOWAIT. And there is no need to print warning calltrace if a discard bio...

Ethercreative Logs 3.0.3 - Path Traversal

Exploit Title: Ethercreative Logs 3.0.3 - Path Traversal Date: 2022.01.26 Exploit Author: Steffen Rogge, SC Vendor Homepage: https://github.com/ethercreative/logs Software Link: https://plugins.craftcms.com/logs Version: =3.0.4 impact: Medium found: 2021-07-06 SEC Consult Vulnerability Lab An...

PYSEC-2025-35

Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If, for example, the source code...

CVE-2025-32021 Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext

Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If, for example, the source code...

CVE-2025-32021 Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext

Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters during the creation process. If, for example, the source code...

Directus inserts access token from query string into logs

Summary Access token from query string is not redacted and is potentially exposed in system logs which may be persisted. Details The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are not properly sanitized or protected, an attacker with access to it can...

GHSA-VW58-PH65-6RXP Directus inserts access token from query string into logs

Summary Access token from query string is not redacted and is potentially exposed in system logs which may be persisted. Details The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are not properly sanitized or protected, an attacker with access to it can...

CVE-2024-47822

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

The vulnerability of the Ruby interpreter’s Rack module interface allows attackers to influence the integrity of the protected information.

The vulnerability of the Ruby interpreter’s Rack module interface is related to improper processing of output data for registration logs. Exploiting this vulnerability allows an attacker to influence the integrity of the protected information...

Device Posture Portal page error "CheckAgain" or "Download EPA client" | Status code 307

End users encounter issues at the Device Posture Portal when attempting to log into the Workspace URL. They are prompted to "Check Again" or "Download EPA client," despite already having the client installed on their device. Checking endpoint logs, we see the following error: The Windows client...

CVE-2025-24866

Mattermost versions 9.11.x = 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs...