CVE-2026-7302

creationtimestamp| type| source ---|---|--- 2026-05-18 17:00:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mm5e2l2fzt2g...

CVE-2026-41947

creationtimestamp| type| source ---|---|--- 2026-05-18 16:56:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm5dtbyy3q2o 2026-05-19 06:00:48+00:00| seen| https://infosec.exchange/users/offseq/statuses/116599714465595162 2026-06-09 19:53:31+00:00| seen|...

CVE-2026-26462

creationtimestamp| type| source ---|---|--- 2026-05-18 16:37:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm5cqqq5xl2k 2026-05-30 11:00:50+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mn2vjwfts32z...

CVE-2026-40796

creationtimestamp| type| source ---|---|--- 2026-05-18 16:33:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mm5cizjp7a2c...

GHSA-GQR2-7HCG-RCHF CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

Summary The Pages backend module registers the htmlpurify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages Home::index → app/Views/templates/default/pages.php emits $pageInfo-content without esc, yielding...

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

Summary The Pages backend module registers the htmlpurify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages Home::index → app/Views/templates/default/pages.php emits $pageInfo-content without esc, yielding...

CVE-2026-5163

creationtimestamp| type| source ---|---|--- 2026-05-18 14:44:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm54ha7ldl2i...

CVE-2026-4320

creationtimestamp| type| source ---|---|--- 2026-05-18 12:56:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4wfejqwn2n...

CVE-2026-41119

creationtimestamp| type| source ---|---|--- 2026-05-18 12:51:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4w4g2zc52h...

CVE-2026-7301

creationtimestamp| type| source ---|---|--- 2026-05-18 12:28:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mm4ut5mmst2p...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the post rewrite endpoint. An attacker can gain unauthorized access to the content of threads in private channels and direct messages by sending a crafted request. Remediation Upgrade...

Missing Authorization

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Missing Authorization via the post rewrite endpoint. An attacker can gain unauthorized access to the content of threads in private channels and...

CVE-2026-8751

creationtimestamp| type| source ---|---|--- 2026-05-18 11:39:38+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mm4s4budgk23...

From Cryptographic Blind Spots to Post-Quantum Agility: Introducing Wiz for PQC Readiness

Eliminate cryptographic blind spots and neutralize legacy debt with an integrated cryptographic asset inventory. Identify risks across code, cloud, and runtime, using the Wiz Security Graph to prioritize migration and protect against "Harvest Now, Decrypt Later" attacks...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the post update and patch API endpoints. An attacker can modify existing posts despite lacking posting privileges by sending crafted API requests. Remediation Upgrade...

GHSA-8R89-8W26-CQ32 Mattermost doesn't verify channel membership when processing AI-assisted message rewrites

Mattermost versions 11.5.x = 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite...

Mattermost doesn't verify channel membership when processing AI-assisted message rewrites

Mattermost versions 11.5.x = 11.5.1 fail to verify channel membership when processing AI-assisted message rewrites which allows an authenticated attacker to read the content of threads in private channels and direct messages they do not have access to via a crafted request to the post rewrite...

GHSA-M3P3-8FRQ-Q7QH Mattermost doesn't limit the size of the request body on the start meeting API endpoint

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to...

Mattermost doesn't limit the size of the request body on the start meeting API endpoint

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to...

GHSA-V549-XX3C-6PC8 Mattermost doesn't check the create_post channel permission during post edit operations

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to check the createpost channel permission during post edit operations which allows an authenticated attacker with revoked posting privileges to modify their existing posts via direct API requests to the post update and...