CVE-2026-10527

Mattermost versions up to 11.7.6, 10.11.21, and 11.8.3 fail to reconcile SchemeAdmin flags with role changes, allowing a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI. CVSS 6.3 MEDIUM, network exploitable with low pri...

EUVD-2026-60192

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

CVE-2026-10527

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

EUVD-2026-60207

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API...

CVE-2026-16046

Mattermost versions 11.7.x ≤ 11.7.6 and 10.11.x ≤ 10.11.21 lack run-state validation on write operations for completed playbook runs, enabling authenticated participants to alter status, checklists, retrospective content, ownership, and participants via REST and GraphQL APIs. No patch version or ...

CVE-2026-16046 Missing run-state validation on finished playbook runs

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API...

CVE-2026-16046

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API...

CVE-2026-16046 Missing run-state validation on finished playbook runs

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API...

CVE-2026-16046

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API...

CVE-2026-16046 Missing run-state validation on finished playbook runs

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API...

WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via REST API 'businessid' Parameter vulnerability discovered by MatilJ in WordPress Plugin Online Booking & Scheduling Calendar for WordPress by vcita versions = 4.6.0...

BIT-SUPERSET-2026-23981 Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs dashboards to associate the char...

BIT-NIFI-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted...

BIT-NIFI-2026-68980 Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

BIT-NIFI-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

PT-2026-73438

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs dashboards to associate the char...

PT-2026-76667

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

PT-2026-78280

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master QSM versions prior to 11.2.4 Description The plugin fails to perform a per-object ownership check on REST routes that return the email-notification and results-page configuration of a quiz. This allows users with...

WordPress Events Manager 7.4 Unauthenticated Administrator Privilege Escalation

WordPress Events Manager versions 7.4 and below contain an unauthenticated privilege escalation vulnerability caused by improper capability mapping for event and location post identifiers. An unauthenticated attacker can exploit a collision between a WordPress user ID and an Events Manager post I...

PT-2026-73391

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...