CVE-2026-4274

Mattermost CVE-2026-4274 affects multiple release lines: 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, and 11.3.x

CVE-2026-4274 Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared...

CVE-2026-4274 Insufficient authorization in shared channel membership sync grants team-level access instead of channel-level access

Mattermost versions 11.2.x = 11.2.2, 10.11.x = 10.11.10, 11.4.x = 11.4.0, 11.3.x = 11.3.1 fail to restrict team-level access when processing membership sync from a remote cluster, which allows a malicious remote cluster to grant a user access to an entire private team instead of only the shared...

EUVD-2025-209042

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()

...

CVE-2025-15433 Shared Files < 1.7.58 - Contributor+ Arbitrary File Download

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

CVE-2025-15433 Shared Files < 1.7.58 - Contributor+ Arbitrary File Download

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

CVE-2025-15433

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

CVE-2025-15433

The Shared Files WordPress plugin versions prior to 1.7.58 is vulnerable to a path traversal vector. This flaw allows users with a role as low as Contributor to download arbitrary files from the web server, including sensitive files such as wp-config.php . No specific exploit links or remediation...

Malicious Package

Overview cr-static-shared-components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PT-2026-28212

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

PT-2026-38147

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.96 Description A race condition in Shared Storage allows a remote attacker who has already compromised the renderer process to leak cross-origin data using a specially crafted HTML page. Recommendatio...

CVE-2025-15433: Undefined Security Weakness

The Shared Files WordPress plugin before 1.7.58 allows users with a role as low as Contributor to download any file on the web server such as wp-config.php via a path traversal vector...

WordPress plugin Shared Files 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Discourse cross-site scripting vulnerability (CNVD-2026-17264)

Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse suffers from a cross-site scripting vulnerability that stems from the onebox method in the SharedAiConversation model rendering...

The vulnerability of the `btrfs_clear_buffer_dirty()` function in the `fs/btrfs/extent_io.c` module of the btrfs file system support module in the Linux operating system allows a attacker to compromise the integrity of protected information or cause service failures.

The vulnerability of the btrfsclearbufferdirty function in the fs/btrfs/extentio.c module of the Btrfs file system support in Linux’s kernel is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow an attacker to compromise the integrity of...

CVE-2026-23286

A flaw was found in the Linux kernel's ATM LANE LAN Emulation module. When an Asynchronous Transfer Mode Virtual Channel Connection atmvcc is shared across multiple entries, a vulnerability in the lecarpclearvccs function can lead to a null-pointer dereference. This occurs when the function...

SUSE CVE-2026-23286

In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix null-ptr-deref in lecarpclearvccs syzkaller reported a null-ptr-deref in lecarpclearvccs. This issue can be easily reproduced using the syzkaller reproducer. In the ATM LANE LAN Emulation module, the same atmvcc can...

Identity security is the new pressure point for modern cyberattacks

Identity attacks no longer hinge on who a cyberattacker compromises, but on what that identity can access. As organizations manage growing numbers of human, non-human, and agentic identities, their access fabric multiplies across apps, resources, and environments, which increases both operational...

CVE-2026-23345

A flaw was found in the Linux kernel. When the FEATLPA2 feature is enabled on ARM64 systems, the kernel incorrectly handles the PTESHARED bits in Graphics Control System GCS memory mappings. This misconfiguration can lead to a kernel paging request and subsequently a system panic, resulting in a...