CVE-2026-57744

creationtimestamp| type| source ---|---|--- 2026-07-13 10:43:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjj3ams7d2e 2026-07-13 11:26:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjlhle6wj22 2026-07-13 11:28:18+00:00| seen|...

CVE-2026-57770

creationtimestamp| type| source ---|---|--- 2026-07-13 10:41:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjiyawyja25 2026-07-13 11:26:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjlhmqfs62r...

CVE-2026-57811

creationtimestamp| type| source ---|---|--- 2026-07-13 10:40:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjivgc6hi2g 2026-07-13 11:28:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqjll56d3f2h 2026-07-13 18:16:29+00:00| seen|...

CVE-2026-10103

creationtimestamp| type| source ---|---|--- 2026-07-13 09:48:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjfz3xeav2g 2026-07-13 09:49:50+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqjg3ih5wi2l 2026-07-13 09:49:51+00:00| seen|...

CVE-2026-9708

creationtimestamp| type| source ---|---|--- 2026-07-13 09:41:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjflymjrr25 2026-07-13 09:51:01+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqjg5lvm5z2d 2026-07-13 09:51:01+00:00| seen|...

CVE-2026-10106

creationtimestamp| type| source ---|---|--- 2026-07-13 09:39:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjfj5xjzo2x 2026-07-13 09:41:01+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjflpgeyb2y 2026-07-14 01:24:35+00:00| seen|...

CVE-2026-6850

creationtimestamp| type| source ---|---|--- 2026-07-13 09:38:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqjfgfdc4x26 2026-07-13 09:48:04+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqjfycu6co22 2026-07-13 09:48:06+00:00| seen|...

EUVD-2026-43307

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing...

EUVD-2026-43312

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to verify that the channel referenced in an action cookie matches the channel of the target post, which allows an authenticated user without access to a private channel to trigger interactive post actions on posts in th...

EUVD-2026-43289

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-10103

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing...

CVE-2026-10103

Mattermost versions affected: 11.7.x (up to 11.7.2), 11.6.x (up to 11.6.4), and 10.11.x (up to 10.11.19) have a flaw in the shared channel inbound sync handler that fails to verify post ownership. This allows an authenticated remote cluster to modify or delete posts authored by local users or oth...

CVE-2026-12274

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-12274 Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-7162

creationtimestamp| type| source ---|---|--- 2026-07-13 05:00:18+00:00| seen| https://bsky.app/profile/potato.software/post/3mqivvr66wf2l 2026-07-13 05:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqivvqbkwr2w 2026-07-13 07:21:40+00:00| seen|...

CVE-2026-15522

creationtimestamp| type| source ---|---|--- 2026-07-13 03:28:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqiqseevj52c 2026-07-13 03:32:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqiqz75lmn2x 2026-07-13 21:03:37+00:00| seen|...

CVE-2026-15523

creationtimestamp| type| source ---|---|--- 2026-07-13 03:27:57+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqiqqmy34f2d 2026-07-13 04:03:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqisqsy3vf26...

CVE-2026-15515

creationtimestamp| type| source ---|---|--- 2026-07-13 01:29:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqik4jlf3e2x 2026-07-13 01:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116910078363580201 2026-07-13 01:30:27+00:00| seen|...

PT-2026-57636

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-leve...

CVE-2026-10103: Authorization Bypass Through User-Controlled Key

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing...